# CVE-2022-48800: linux: In the Linux kernel, the following vulnerability has been resolved:  mm: vmscan: remove deadlock due to throttling fa...

CVE-2022-48800 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48800, released July 16, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-48800
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 16, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  mm: vmscan: remove deadlock due to throttling failing to make progress  A soft lockup bug in kcompactd was reported in a private bugzilla with the following visible in dmesg;    watchdog: BUG: soft lockup - CPU#33 stuck for 26s! [kcompactd0:479]   watchdog: BUG: soft lockup - CPU#33 stuck for 52s! [kcompactd0:479]   watchdog: BUG: soft lockup - CPU#33 stuck for 78s! [kcompactd0:479]   watchdog: BUG: soft lockup - CPU#33 stuck for 104s! [kcompactd0:479]  The machine had 256G of RAM with no swap and an earlier failed allocation indicated that node 0 where kcompactd was run was potentially unreclaimable;    Node 0 active_anon:29355112kB inactive_anon:2913528kB active_file:0kB     inactive_file:0kB unevictable:64kB isolated(anon):0kB isolated(file):0kB     mapped:8kB dirty:0kB writeback:0kB shmem:26780kB shmem_thp:     0kB shmem_pmdmapped: 0kB anon_thp: 23480320kB writeback_tmp:0kB     kernel_stack:2272kB pagetables:24500kB all_unreclaimable? yes  Vlastimil Babka investigated a crash dump and found that a task migrating pages was trying to drain PCP lists;    PID: 52922  TASK: ffff969f820e5000  CPU: 19  COMMAND: "kworker/u128:3"   Call Trace:      __schedule      schedule      schedule_timeout      wait_for_completion      __flush_work      __drain_all_pages      __alloc_pages_slowpath.constprop.114      __alloc_pages      alloc_migration_target      migrate_pages      migrate_to_node      do_migrate_pages      cpuset_migrate_mm_workfn      process_one_work      worker_thread      kthread      ret_from_fork  This failure is specific to CONFIG_PREEMPT=n builds.  The root of the problem is that kcompact0 is not rescheduling on a CPU while a task that has isolated a large number of the pages from the LRU is waiting on kcompact0 to reschedule so the pages can be released.  While shrink_inactive_list() only loops once around too_many_isolated, reclaim can continue without rescheduling if sc->skipped_deactivate == 1 which could happen if there was no file LRU and the inactive anon list was not low.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.16.10-1 | [DEBIAN-CVE-2022-48800](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48800.md) | Jul 16, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.16.10-1 | [DEBIAN-CVE-2022-48800](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48800.md) | Jul 16, 2024 |
| Linux | linux Debian 14 | 5.16.10-1 | [DEBIAN-CVE-2022-48800](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48800.md) | Jul 16, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.