# CVE-2022-48659: linux: In the Linux kernel, the following vulnerability has been resolved:  mm/slub: fix to return errno if kmalloc() fails...

CVE-2022-48659 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48659, released April 28, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-48659
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 28, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm/slub: fix to return errno if kmalloc() fails  In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic via BUG_ON();  kernel BUG at mm/slub.c:5893! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP  Call trace:  sysfs_slab_add+0x258/0x260 mm/slub.c:5973  __kmem_cache_create+0x60/0x118 mm/slub.c:4899  create_cache mm/slab_common.c:229 [inline]  kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335  kmem_cache_create+0x1c/0x28 mm/slab_common.c:390  f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]  f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808  f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149  mount_bdev+0x1b8/0x210 fs/super.c:1400  f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512  legacy_get_tree+0x30/0x74 fs/fs_context.c:610  vfs_get_tree+0x40/0x140 fs/super.c:1530  do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040  path_mount+0x358/0x914 fs/namespace.c:3370  do_mount fs/namespace.c:3383 [inline]  __do_sys_mount fs/namespace.c:3591 [inline]  __se_sys_mount fs/namespace.c:3568 [inline]  __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.0.2-1 | [DEBIAN-CVE-2022-48659](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48659.md) | Apr 28, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.0.2-1 | [DEBIAN-CVE-2022-48659](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48659.md) | Apr 28, 2024 |
| Linux | linux Debian 14 | 6.0.2-1 | [DEBIAN-CVE-2022-48659](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48659.md) | Apr 28, 2024 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.