CVE-2022-48636

s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup

State: Published
Severity: 7.8 High
Published: Apr 28, 2024
Updated: Aug 5, 2026
Reserved: Feb 25, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup

Fix Oops in dasd_alias_get_start_dev() function caused by the pavgroup pointer being NULL.

The pavgroup pointer is checked on the entrance of the function but without the lcu->lock being held. Therefore there is a race window between dasd_alias_get_start_dev() and _lcu_update() which sets pavgroup to NULL with the lcu->lock held.

Fix by checking the pavgroup pointer with lcu->lock held.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	8e09f21574ea3028d5629e5de759e0b196c690c5 to before d86b4267834e6d4af62e3073e48166e349ab1b70Affected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before 49f401a98b318761ca2e15d4c7869a20043fbed4Affected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before aaba5ff2742043705bc4c02fd0b2b246e2e16da1Affected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before 2e473351400e3dd66f0b71eddcef82ee45a584c1Affected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before f5fcc9d6d71d9ff7fdbdd4b89074e6e24fffc20bAffected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before d3a67c21b18f33c79382084af556557c442f12a6Affected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before 650a2e79d176db753654d3dde88e53a2033036acAffected 8e09f21574ea3028d5629e5de759e0b196c690c5 to before db7ba07108a48c0f95b74fabbfd5d63e924f992dAffected
LinuxLinux	2.6.25Affected before 2.6.25Not affected 4.9.330 through 4.9.Not affected 4.14.295 through 4.14.Not affected 4.19.260 through 4.19.Not affected 5.4.215 through 5.4.Not affected 5.10.146 through 5.10.Not affected 5.15.71 through 5.15.Not affected 5.19.12 through 5.19.*Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

8e09f21574ea3028d5629e5de759e0b196c690c5 to before d86b4267834e6d4af62e3073e48166e349ab1b70Affected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before 49f401a98b318761ca2e15d4c7869a20043fbed4Affected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before aaba5ff2742043705bc4c02fd0b2b246e2e16da1Affected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before 2e473351400e3dd66f0b71eddcef82ee45a584c1Affected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before f5fcc9d6d71d9ff7fdbdd4b89074e6e24fffc20bAffected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before d3a67c21b18f33c79382084af556557c442f12a6Affected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before 650a2e79d176db753654d3dde88e53a2033036acAffected
8e09f21574ea3028d5629e5de759e0b196c690c5 to before db7ba07108a48c0f95b74fabbfd5d63e924f992dAffected

LinuxLinux

2.6.25Affected
before 2.6.25Not affected
4.9.330 through 4.9.*Not affected
4.14.295 through 4.14.*Not affected
4.19.260 through 4.19.*Not affected
5.4.215 through 5.4.*Not affected
5.10.146 through 5.10.*Not affected
5.15.71 through 5.15.*Not affected
5.19.12 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.