Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2022-48950

perf: Fix perf_pending_task() UaF

High7.8EPSS 0.25%
Published
Updated
Reserved
Assigned by
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already queued before destroying the event; - destroying the event itself queues the task_work. The first cannot be solved using task_work_cancel() since perf_release() itself might be called from a task_work (____fput), which means the current->task_works list is already empty and task_work_cancel() won't be able to find the perf_pending_task() entry. The simplest alternative is extending the perf_event lifetime to cover the task_work. The second is just silly, queueing a task_work while you know the event is going away makes no sense and is easily avoided by re-arranging how the event is marked STATE_DEAD and ensuring it goes through STATE_OFF on the way down.

Scores

CVSS scores of CVE-2022-48950, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.25% · top 83% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

Affected products

  • Linux · Linux

    • affected ca7b0a10287e2733bdafb01ef0d4038536625fe3 – < 8bffa95ac19ff27c8261904f89d36c7fcf215d59
    • affected 078c12ccf1fb943cc18c84894c76113dc89e5975 – < 78e1317a174edbfd1182599bf76c092a2877672c
    • affected ca6c21327c6af02b7eec31ce4b9a740a18c6c13f – < 517e6a301f34613bff24a8e35b5455884f2d83d8

  • Linux · Linux

    • affected 5.15.77 – < 5.15.84
    • affected 6.0.7 – < 6.0.14

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2022-48950 badge
[![CVE-2022-48950](https://trackcve.app/badge/CVE-2022-48950.svg)](https://trackcve.app/cve/CVE-2022-48950)

Record last updated .