CVE-2022-49053: linux kernel Use-After-Free — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().

Is your site exposed to CVE-2022-49053?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-416 Use After Free

Affected Products

Vendor	Product	Versions
linux	linux_kernel	< 4.14.276
linux	linux_kernel	4.15 — 4.19.239
linux	linux_kernel	4.20 — 5.4.190
linux	linux_kernel	5.5 — 5.10.112
linux	linux_kernel	5.11 — 5.15.35
linux	linux_kernel	5.16 — 5.17.4
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/a6968f7a367f128d120447360734344d5a3d5336 https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d2182154294a4b https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626 https://git.kernel.org/stable/c/b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322 https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141e3db1f977a0dd4e8e https://git.kernel.org/stable/c/e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed https://git.kernel.org/stable/c/fb7a5115422fbd6a4d505e8844f1ef5529f10489

Frequently Asked Questions

What is CVE-2022-49053? +

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2022-49053? +

CVE-2022-49053 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2022-49053? +

CVE-2022-49053 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2022-49053? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-55406

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the …

CVE-2026-6040

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the …

CVE-2025-24898

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice …

CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder …

CVE-2025-31498

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue …

CVE-2025-4516

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an …

CVE-2022-49053