CVE-2022-3910

linux: Use After Free vulnerability in Linux Kernel allows Privilege Escalation

CVE-2022-3910 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-3910, released November 22, 2022. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
7.8
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0107
65th percentile

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately. We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679

Where it's fixed

ProductFixed inFixReleased
Linux
linux · Debian 12.15 (bookworm) 5.19.11-1 DEBIAN-CVE-2022-3910 Nov 22, 2022
linux · Debian 13.5 (trixie) 5.19.11-1 DEBIAN-CVE-2022-3910 Nov 22, 2022
linux · Debian 14 5.19.11-1 DEBIAN-CVE-2022-3910 Nov 22, 2022

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.