{
  "cveId": "CVE-2022-48986",
  "url": "https://patchblox.com/security/cve/CVE-2022-48986",
  "summary": "CVE-2022-48986 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48986, released October 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  mm/gup: fix gup_pud_range() for dax  For dax pud...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  mm/gup: fix gup_pud_range() for dax  For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn\u0027t depend on hugetlb. Commit 414fd080d125 (\u0022mm/gup: fix gup_pmd_range() for dax\u0022) fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well.  This fixes the below kernel panic:  general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP \t\u003C snip \u003E Call Trace: \u003CTASK\u003E get_user_pages_fast\u002B0x1f/0x40 iov_iter_get_pages\u002B0xc6/0x3b0 ? mempool_alloc\u002B0x5d/0x170 bio_iov_iter_get_pages\u002B0x82/0x4e0 ? bvec_alloc\u002B0x91/0xc0 ? bio_alloc_bioset\u002B0x19a/0x2a0 blkdev_direct_IO\u002B0x282/0x480 ? __io_complete_rw_common\u002B0xc0/0xc0 ? filemap_range_has_page\u002B0x82/0xc0 generic_file_direct_write\u002B0x9d/0x1a0 ? inode_update_time\u002B0x24/0x30 __generic_file_write_iter\u002B0xbd/0x1e0 blkdev_write_iter\u002B0xb4/0x150 ? io_import_iovec\u002B0x8d/0x340 io_write\u002B0xf9/0x300 io_issue_sqe\u002B0x3c3/0x1d30 ? sysvec_reschedule_ipi\u002B0x6c/0x80 __io_queue_sqe\u002B0x33/0x240 ? fget\u002B0x76/0xa0 io_submit_sqes\u002B0xe6a/0x18d0 ? __fget_light\u002B0xd1/0x100 __x64_sys_io_uring_enter\u002B0x199/0x880 ? __context_tracking_enter\u002B0x1f/0x70 ? irqentry_exit_to_user_mode\u002B0x24/0x30 ? irqentry_exit\u002B0x1d/0x30 ? __context_tracking_exit\u002B0xe/0x70 do_syscall_64\u002B0x3b/0x90 entry_SYSCALL_64_after_hwframe\u002B0x61/0xcb RIP: 0033:0x7fc97c11a7be \t\u003C snip \u003E \u003C/TASK\u003E ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast\u002B0x340/0x990 \t\u003C snip \u003E Kernel panic - not syncing: Fatal exception Kernel Offset: disabled",
  "published": "2024-10-21T20:15:10Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00255,
  "epssPercentile": 0.17221,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-48986",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48986",
      "released": "2024-10-21T20:15:10Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-48986",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48986",
      "released": "2024-10-21T20:15:10Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-48986",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48986",
      "released": "2024-10-21T20:15:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}