{
  "cveId": "CVE-2022-48689",
  "url": "https://patchblox.com/security/cve/CVE-2022-48689",
  "summary": "CVE-2022-48689 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48689, released May 3, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  tcp: TX zerocopy should not sense pfmemalloc sta...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  tcp: TX zerocopy should not sense pfmemalloc status  We got a recent syzbot report [1] showing a possible misuse of pfmemalloc page status in TCP zerocopy paths.  Indeed, for pages coming from user space or other layers, using page_is_pfmemalloc() is moot, and possibly could give false positives.  There has been attempts to make page_is_pfmemalloc() more robust, but not using it in the first place in this context is probably better, removing cpu cycles.  Note to stable teams :  You need to backport 84ce071e38a6 (\u0022net: introduce __skb_fill_page_desc_noacc\u0022) as a prereq.  Race is more probable after commit c07aea3ef4d4 (\u0022mm: add a signature in struct page\u0022) because page_is_pfmemalloc() is now using low order bit from page-\u003Elru.next, which can change more often than page-\u003Eindex.  Low order bit should never be set for lru.next (when used as an anchor in LRU list), so KCSAN report is mostly a false positive.  Backporting to older kernel versions seems not necessary.  [1] BUG: KCSAN: data-race in lru_add_fn / tcp_build_frag  write to 0xffffea0004a1d2c8 of 8 bytes by task 18600 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:105 [inline] lru_add_fn\u002B0x440/0x520 mm/swap.c:228 folio_batch_move_lru\u002B0x1e1/0x2a0 mm/swap.c:246 folio_batch_add_and_move mm/swap.c:263 [inline] folio_add_lru\u002B0xf1/0x140 mm/swap.c:490 filemap_add_folio\u002B0xf8/0x150 mm/filemap.c:948 __filemap_get_folio\u002B0x510/0x6d0 mm/filemap.c:1981 pagecache_get_page\u002B0x26/0x190 mm/folio-compat.c:104 grab_cache_page_write_begin\u002B0x2a/0x30 mm/folio-compat.c:116 ext4_da_write_begin\u002B0x2dd/0x5f0 fs/ext4/inode.c:2988 generic_perform_write\u002B0x1d4/0x3f0 mm/filemap.c:3738 ext4_buffered_write_iter\u002B0x235/0x3e0 fs/ext4/file.c:270 ext4_file_write_iter\u002B0x2e3/0x1210 call_write_iter include/linux/fs.h:2187 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write\u002B0x468/0x760 fs/read_write.c:578 ksys_write\u002B0xe8/0x1a0 fs/read_write.c:631 __do_sys_write fs/read_write.c:643 [inline] __se_sys_write fs/read_write.c:640 [inline] __x64_sys_write\u002B0x3e/0x50 fs/read_write.c:640 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64\u002B0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  read to 0xffffea0004a1d2c8 of 8 bytes by task 18611 on cpu 1: page_is_pfmemalloc include/linux/mm.h:1740 [inline] __skb_fill_page_desc include/linux/skbuff.h:2422 [inline] skb_fill_page_desc include/linux/skbuff.h:2443 [inline] tcp_build_frag\u002B0x613/0xb20 net/ipv4/tcp.c:1018 do_tcp_sendpages\u002B0x3e8/0xaf0 net/ipv4/tcp.c:1075 tcp_sendpage_locked net/ipv4/tcp.c:1140 [inline] tcp_sendpage\u002B0x89/0xb0 net/ipv4/tcp.c:1150 inet_sendpage\u002B0x7f/0xc0 net/ipv4/af_inet.c:833 kernel_sendpage\u002B0x184/0x300 net/socket.c:3561 sock_sendpage\u002B0x5a/0x70 net/socket.c:1054 pipe_to_sendpage\u002B0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe\u002B0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage\u002B0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor\u002B0x80/0xa0 fs/splice.c:931 splice_direct_to_actor\u002B0x305/0x620 fs/splice.c:886 do_splice_direct\u002B0xfb/0x180 fs/splice.c:974 do_sendfile\u002B0x3bf/0x910 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64 fs/read_write.c:1303 [inline] __x64_sys_sendfile64\u002B0x10c/0x150 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64\u002B0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  value changed: 0x0000000000000000 -\u003E 0xffffea0004a1d288  Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 18611 Comm: syz-executor.4 Not tainted 6.0.0-rc2-syzkaller-00248-ge022620b5d05-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022",
  "published": "2024-05-03T15:15:07Z",
  "severity": "high",
  "cvss": 7,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00192,
  "epssPercentile": 0.08949,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.19.11-1",
      "fix": "DEBIAN-CVE-2022-48689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48689",
      "released": "2024-05-03T15:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.19.11-1",
      "fix": "DEBIAN-CVE-2022-48689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48689",
      "released": "2024-05-03T15:15:07Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.19.11-1",
      "fix": "DEBIAN-CVE-2022-48689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48689",
      "released": "2024-05-03T15:15:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}