# CVE-2022-48847: linux: In the Linux kernel, the following vulnerability has been resolved:  watch_queue: Fix filter limit check  In watch_qu...

CVE-2022-48847 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48847, released July 16, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-48847
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 16, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  watch_queue: Fix filter limit check  In watch_queue_set_filter(), there are a couple of places where we check that the filter type value does not exceed what the type_filter bitmap can hold.  One place calculates the number of bits by:     if (tf[i].type >= sizeof(wfilter->type_filter) * 8)  which is fine, but the second does:     if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG)  which is not.  This can lead to a couple of out-of-bounds writes due to a too-large type:   (1) __set_bit() on wfilter->type_filter  (2) Writing more elements in wfilter->filters[] than we allocated.  Fix this by just using the proper WATCH_TYPE__NR instead, which is the number of types we actually know about.  The bug may cause an oops looking something like:    BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740   Write of size 4 at addr ffff88800d2c66bc by task watch_queue_oob/611   ...   Call Trace:    <TASK>    dump_stack_lvl+0x45/0x59    print_address_description.constprop.0+0x1f/0x150    ...    kasan_report.cold+0x7f/0x11b    ...    watch_queue_set_filter+0x659/0x740    ...    __x64_sys_ioctl+0x127/0x190    do_syscall_64+0x43/0x90    entry_SYSCALL_64_after_hwframe+0x44/0xae    Allocated by task 611:    kasan_save_stack+0x1e/0x40    __kasan_kmalloc+0x81/0xa0    watch_queue_set_filter+0x23a/0x740    __x64_sys_ioctl+0x127/0x190    do_syscall_64+0x43/0x90    entry_SYSCALL_64_after_hwframe+0x44/0xae    The buggy address belongs to the object at ffff88800d2c66a0    which belongs to the cache kmalloc-32 of size 32   The buggy address is located 28 bytes inside of    32-byte region [ffff88800d2c66a0, ffff88800d2c66c0)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.16.18-1 | [DEBIAN-CVE-2022-48847](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48847.md) | Jul 16, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.16.18-1 | [DEBIAN-CVE-2022-48847](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48847.md) | Jul 16, 2024 |
| Linux | linux Debian 14 | 5.16.18-1 | [DEBIAN-CVE-2022-48847](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48847.md) | Jul 16, 2024 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.