{
  "cveId": "CVE-2022-48983",
  "url": "https://patchblox.com/security/cve/CVE-2022-48983",
  "summary": "CVE-2022-48983 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48983, released October 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring: Fix a null-ptr-deref in io_tctx_exit_c...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()  Syzkaller reports a NULL deref bug as follows:   BUG: KASAN: null-ptr-deref in io_tctx_exit_cb\u002B0x53/0xd3  Read of size 4 at addr 0000000000000138 by task file1/1955   CPU: 1 PID: 1955 Comm: file1 Not tainted 6.1.0-rc7-00103-gef4d3ea40565 #75  Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014  Call Trace:   \u003CTASK\u003E   dump_stack_lvl\u002B0xcd/0x134   ? io_tctx_exit_cb\u002B0x53/0xd3   kasan_report\u002B0xbb/0x1f0   ? io_tctx_exit_cb\u002B0x53/0xd3   kasan_check_range\u002B0x140/0x190   io_tctx_exit_cb\u002B0x53/0xd3   task_work_run\u002B0x164/0x250   ? task_work_cancel\u002B0x30/0x30   get_signal\u002B0x1c3/0x2440   ? lock_downgrade\u002B0x6e0/0x6e0   ? lock_downgrade\u002B0x6e0/0x6e0   ? exit_signals\u002B0x8b0/0x8b0   ? do_raw_read_unlock\u002B0x3b/0x70   ? do_raw_spin_unlock\u002B0x50/0x230   arch_do_signal_or_restart\u002B0x82/0x2470   ? kmem_cache_free\u002B0x260/0x4b0   ? putname\u002B0xfe/0x140   ? get_sigframe_size\u002B0x10/0x10   ? do_execveat_common.isra.0\u002B0x226/0x710   ? lockdep_hardirqs_on\u002B0x79/0x100   ? putname\u002B0xfe/0x140   ? do_execveat_common.isra.0\u002B0x238/0x710   exit_to_user_mode_prepare\u002B0x15f/0x250   syscall_exit_to_user_mode\u002B0x19/0x50   do_syscall_64\u002B0x42/0xb0   entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  RIP: 0023:0x0  Code: Unable to access opcode bytes at 0xffffffffffffffd6.  RSP: 002b:00000000fffb7790 EFLAGS: 00000200 ORIG_RAX: 000000000000000b  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000  RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000  R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000   \u003C/TASK\u003E  Kernel panic - not syncing: panic_on_warn set ...  This happens because the adding of task_work from io_ring_exit_work() isn\u0027t synchronized with canceling all work items from eg exec. The execution of the two are ordered in that they are both run by the task itself, but if io_tctx_exit_cb() is queued while we\u0027re canceling all work items off exec AND gets executed when the task exits to userspace rather than in the main loop in io_uring_cancel_generic(), then we can find current-\u003Eio_uring == NULL and hit the above crash.  It\u0027s safe to add this NULL check here, because the execution of the two paths are done by the task itself.  [axboe: add code comment and also put an explanation in the commit msg]",
  "published": "2024-10-21T20:15:10Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00262,
  "epssPercentile": 0.18065,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-48983",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48983",
      "released": "2024-10-21T20:15:10Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-48983",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48983",
      "released": "2024-10-21T20:15:10Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-48983",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48983",
      "released": "2024-10-21T20:15:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}