arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud

Description

In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud The page table check trigger BUG_ON() unexpectedly when collapse hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:82! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Call trace: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it decrease file_map_count for a non-leaf pmd comes from collapse_huge_page(). and so trigger BUG_ON() unexpectedly. Fix this problem by using pmd_leaf() insteal of pmd_present() in pmd_user_accessible_page(). Moreover, use pud_leaf() for pud_user_accessible_page() too.

Scores

EPSS (exploitation in 30 days)

0.17% · top 94% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• CWE-617 (opens in a new tab)All about CWE-617 and its CVEs

Affected products

• Linux · Linux

  • affected 42b2547137f5c974bb1bfd657c869fe96b96d86f – < 2d458046df634088611d44fd77f45465e833ef78
  • affected 42b2547137f5c974bb1bfd657c869fe96b96d86f – < 5b47348fc0b18a78c96f8474cc90b7525ad1bbfe

• Linux · Linux

  • affected 5.19
  • unaffected < 5.19
  • unaffected 6.0.10 – ≤ 6.0.*
  • unaffected 6.1 – ≤ *

References (2)

• https://git.kernel.org/stable/c/2d458046df634088611d44fd77f45465e833ef78 (opens in a new tab)
• https://git.kernel.org/stable/c/5b47348fc0b18a78c96f8474cc90b7525ad1bbfe (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-49778](https://trackcve.app/badge/CVE-2022-49778.svg)](https://trackcve.app/cve/CVE-2022-49778)

Record last updated 11 May 2026, 19:06 UTC.