CVE-2022-49554 zsmalloc: fix races between asynchronous zspage free and page migration
A race condition in the Linux kernel's zsmalloc subsystem can lead to unsafe memory dereferences and potential system crashes during page migration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49554?
CVE-2022-49554 is a high-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
zsmalloc: fix races between asynchronous zspage free and page migration
The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races.
It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process).
Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.
Weakness: CWE-362
Which versions are affected by CVE-2022-49554?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49554?
Apply the vendor's patch.
Is CVE-2022-49554 being exploited?
There is no known exploitation of CVE-2022-49554 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49554, GHSA-wv76-pjmf-rxjc, UBUNTU-CVE-2022-49554.