CVE-2022-49162 video: fbdev: sm712fb: Fix crash in smtcfb_write()
A local attacker can crash the Linux kernel by writing three bytes to the sm712fb framebuffer device, causing a page fault.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49162?
CVE-2022-49162 is a high-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
video: fbdev: sm712fb: Fix crash in smtcfb_write()
When the sm712fb driver writes three bytes to the framebuffer, the driver will crash:
BUG: unable to handle page fault for address: ffffc90001ffffff RIP: 0010:smtcfb_write+0x454/0x5b0 Call Trace: vfs_write+0x291/0xd60 ? do_sys_openat2+0x27d/0x350 ? __fget_light+0x54/0x340 ksys_write+0xce/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
Fix it by removing the open-coded endianness fixup-code.
Which versions are affected by CVE-2022-49162?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49162?
Apply the vendor's patch.
Is CVE-2022-49162 being exploited?
There is no known exploitation of CVE-2022-49162 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49162, GHSA-7rcf-f323-7594, UBUNTU-CVE-2022-49162.