{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-48633 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-48633 is a medium-severity vulnerability in Linux kernel, published on 28 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-48633 and fix it if it is affected.\n\nWhat it is: CVE-2022-48633 is a medium-severity vulnerability in Linux kernel, published on 28 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-48633 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-48633/ (Markdown: https://insights.sbomify.com/CVE-2022-48633/index.md)","id":"CVE-2022-48633","markdown":"https://insights.sbomify.com/CVE-2022-48633/index.md","name":"CVE-2022-48633","record":{"aliases":["DEBIAN-CVE-2022-48633","GHSA-9939-379m-g97w","ROOT-OS-DEBIAN-11-CVE-2022-48633","ROOT-OS-UBUNTU-2204-CVE-2022-48633","UBUNTU-CVE-2022-48633"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel DRM driver","requires_auth":"low_privilege","summary":"A use-after-free condition in the gma500 DRM driver can cause a kernel warning and potential system crash when releasing graphics objects.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-617","name":"Reachable Assertion"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock-\u003emagic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[   79.693962] ------------[ cut here ]------------\n[   79.693992] DEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\n[   79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[   79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G        W   E      6.0.0-rc3+ #490\n[   79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[   79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff \u003c0f\u003e 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[   79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[   79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[   79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[   79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[   79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[   79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[   79.694690] FS:  00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[   79.694705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[   79.694734] Call Trace:\n[   79.694749]  \u003cTASK\u003e\n[   79.694761]  ? __schedule+0x47f/0x1670\n[   79.694796]  ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694830]  ? lock_is_held_type+0xe3/0x140\n[   79.694864]  ? ww_mutex_lock+0x38/0xa0\n[   79.694885]  ? __cond_resched+0x1c/0x30\n[   79.694902]  ww_mutex_lock+0x38/0xa0\n[   79.694925]  psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694964]  psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[   79.694996]  drm_gem_object_release_handle+0x50/0x60\n[   79.695020]  ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[   79.695042]  idr_for_each+0x4b/0xb0\n[   79.695066]  ? _raw_spin_unlock_irqrestore+0x30/0x60\n[   79.695095]  drm_gem_release+0x1c/0x30\n[   79.695118]  drm_file_free.part.0+0x1ea/0x260\n[   79.695150]  drm_release+0x6a/0x120\n[   79.695175]  __fput+0x9f/0x260\n[   79.695203]  task_work_run+0x59/0xa0\n[   79.695227]  do_exit+0x387/0xbe0\n[   79.695250]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[   79.695275]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695304]  do_group_exit+0x33/0xb0\n[   79.695331]  __x64_sys_exit_group+0x14/0x20\n[   79.695353]  do_syscall_64+0x58/0x80\n[   79.695376]  ? up_read+0x17/0x20\n[   79.695401]  ? lock_is_held_type+0xe3/0x140\n[   79.695429]  ? asm_exc_page_fault+0x22/0x30\n[   79.695450]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695473]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   79.695493] RIP: 0033:0x7ff1ccefe3f1\n[   79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[   79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/gma500: Fix WARN_ON(lock-\u003emagic != lock) error","id":"CVE-2022-48633","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2022"},"n_packages":0,"n_references":2,"next":{"headline":"drm/gma500: Fix BUG: sleeping function called from invalid context errors","id":"CVE-2022-48634"},"packages":[],"prev":{"headline":"i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()","id":"CVE-2022-48632"},"products":["Linux"],"published":"2024-04-28","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-12","vendors":["Linux"]},"summary":"A use-after-free condition in the gma500 DRM driver can cause a kernel warning and potential system crash when releasing graphics objects.","url":"https://insights.sbomify.com/CVE-2022-48633/"}