{
  "cveId": "CVE-2022-48700",
  "url": "https://patchblox.com/security/cve/CVE-2022-48700",
  "summary": "CVE-2022-48700 is fixed in linux on 1 platform, first by CVE-2022-48700, released May 3, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/type1: Unpin zero pages\n\nThere\u0027s currently...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/type1: Unpin zero pages\n\nThere\u0027s currently a reference count leak on the zero page.  We increment\nthe reference via pin_user_pages_remote(), but the page is later handled\nas an invalid/reserved page, therefore it\u0027s not accounted against the\nuser and not unpinned by our put_pfn().\n\nIntroducing special zero page handling in put_pfn() would resolve the\nleak, but without accounting of the zero page, a single user could\nstill create enough mappings to generate a reference count overflow.\n\nThe zero page is always resident, so for our purposes there\u0027s no reason\nto keep it pinned.  Therefore, add a loop to walk pages returned from\npin_user_pages_remote() and unpin any zero pages.",
  "published": "2024-05-03T16:15:08Z",
  "severity": "",
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "5.10.148-1",
      "fix": "CVE-2022-48700",
      "url": "https://patchblox.com/security/fix/linux/cve-2022-48700",
      "released": "2024-05-03T16:15:08Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.19.11-1",
      "fix": "CVE-2022-48700",
      "url": "https://patchblox.com/security/fix/linux/cve-2022-48700",
      "released": "2024-05-03T16:15:08Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.19.11-1",
      "fix": "CVE-2022-48700",
      "url": "https://patchblox.com/security/fix/linux/cve-2022-48700",
      "released": "2024-05-03T16:15:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}