{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-48940 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-48940 is a high-severity memory corruption vulnerability in Linux kernel, published on 22 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-48940 and fix it if it is affected.\n\nWhat it is: CVE-2022-48940 is a high-severity memory corruption vulnerability in Linux kernel, published on 22 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-48940 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-48940/ (Markdown: https://insights.sbomify.com/CVE-2022-48940/index.md)","id":"CVE-2022-48940","markdown":"https://insights.sbomify.com/CVE-2022-48940/index.md","name":"CVE-2022-48940","record":{"aliases":["DEBIAN-CVE-2022-48940","GHSA-rc9p-g2q3-x488","UBUNTU-CVE-2022-48940"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel BPF","requires_auth":"low_privilege","summary":"A flaw in the Linux kernel BPF subsystem causes a crash when copying map values containing both spin locks and timers, leading to denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix crash due to incorrect copy_map_value\n\nWhen both bpf_spin_lock and bpf_timer are present in a BPF map value,\ncopy_map_value needs to skirt both objects when copying a value into and\nout of the map. However, the current code does not set both s_off and\nt_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock\nis placed in map value with bpf_timer, as bpf_map_update_elem call will\nbe able to overwrite the other timer object.\n\nWhen the issue is not fixed, an overwriting can produce the following\nsplat:\n\n[root@(none) bpf]# ./test_progs -t timer_crash\n[   15.930339] bpf_testmod: loading out-of-tree module taints kernel.\n[   16.037849] ==================================================================\n[   16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325\n[   16.039399]\n[   16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G           OE     5.16.0+ #278\n[   16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014\n[   16.040485] Call Trace:\n[   16.040645]  \u003cTASK\u003e\n[   16.040805]  dump_stack_lvl+0x59/0x73\n[   16.041069]  ? __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.041427]  kasan_report.cold+0x116/0x11b\n[   16.041673]  ? __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.042040]  __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.042328]  ? memcpy+0x39/0x60\n[   16.042552]  ? pv_hash+0xd0/0xd0\n[   16.042785]  ? lockdep_hardirqs_off+0x95/0xd0\n[   16.043079]  __bpf_spin_lock_irqsave+0xdf/0xf0\n[   16.043366]  ? bpf_get_current_comm+0x50/0x50\n[   16.043608]  ? jhash+0x11a/0x270\n[   16.043848]  bpf_timer_cancel+0x34/0xe0\n[   16.044119]  bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81\n[   16.044500]  bpf_trampoline_6442477838_0+0x36/0x1000\n[   16.044836]  __x64_sys_nanosleep+0x5/0x140\n[   16.045119]  do_syscall_64+0x59/0x80\n[   16.045377]  ? lock_is_held_type+0xe4/0x140\n[   16.045670]  ? irqentry_exit_to_user_mode+0xa/0x40\n[   16.046001]  ? mark_held_locks+0x24/0x90\n[   16.046287]  ? asm_exc_page_fault+0x1e/0x30\n[   16.046569]  ? asm_exc_page_fault+0x8/0x30\n[   16.046851]  ? lockdep_hardirqs_on+0x7e/0x100\n[   16.047137]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   16.047405] RIP: 0033:0x7f9e4831718d\n[   16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48\n[   16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023\n[   16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d\n[   16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0\n[   16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0\n[   16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30\n[   16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[   16.051608]  \u003c/TASK\u003e\n[   16.051762] ==================================================================","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf: Fix crash due to incorrect copy_map_value","id":"CVE-2022-48940","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"memory_corruption","year":"2022"},"n_packages":0,"n_references":3,"next":{"headline":"ice: fix concurrent reset and removal of VFs","id":"CVE-2022-48941"},"packages":[],"prev":{"headline":"bpf: Add schedule points in batch ops","id":"CVE-2022-48939"},"products":["Linux"],"published":"2024-08-22","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A flaw in the Linux kernel BPF subsystem causes a crash when copying map values containing both spin locks and timers, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2022-48940/"}