Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-49778: Linux kernel can crash when collapsing huge pages
CVE-2022-49778 · published 1 year ago
Summary
The Linux kernel on ARM64 systems may unexpectedly stop working when it tries to shrink large memory blocks, because it counts files incorrectly. This can cause a sudden system error (kernel BUG). Updating to a kernel version that includes the fix prevents the crash.
What to do
- Update debian linux to version 6.0.10-1.
- Update linux kernel to version 6.0.10.
- Update linux linux_kernel to version 6.0.10 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.19, < 6.0.10 6.1 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Debian:12 | debian | linux |
< 6.0.10-1 Fix: upgrade to 6.0.10-1
|
| Linux | linux | kernel |
>= 5.19.0, < 6.0.10 Fix: upgrade to 6.0.10
|
Original advisory text
arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud
In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud The page table check trigger BUG_ON() unexpectedly when collapse hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:82! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Call trace: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it decrease file_map_count for a non-leaf pmd comes from collapse_huge_page(). and so trigger BUG_ON() unexpectedly. Fix this problem by using pmd_leaf() insteal of pmd_present() in pmd_user_accessible_page(). Moreover, use pud_leaf() for pud_user_accessible_page() too.
References
- https://git.kernel.org/stable/c/2d458046df634088611d44fd77f45465e833ef78 URL
- https://git.kernel.org/stable/c/5b47348fc0b18a78c96f8474cc90b7525ad1bbfe URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49778... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-49778 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://security-tracker.debian.org/tracker/CVE-2022-49778 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-617Reachable Assertion
Timeline
Published1 May 2025
Updated26 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta