Riskcovery

CVE-2022-48730

dma-buf: heaps: Fix potential spectre v1 gadget

State
Published
Severity
Not scored
Published
Jun 20, 2024
Updated
May 11, 2026
Reserved
Jun 20, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: heaps: Fix potential spectre v1 gadget

It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec.

[sumits: added fixes and cc: stable tags]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c02a81fba74fe3488ad6b08bfb5a1329005418f8 to before 5d40f1bdad3dd1a177f21a90ad4353c1ed40ba3aAffected
  • c02a81fba74fe3488ad6b08bfb5a1329005418f8 to before 24f8e12d965b24f8aea762589e0e9fe2025c005eAffected
  • c02a81fba74fe3488ad6b08bfb5a1329005418f8 to before cc8f7940d9c2d45f67b3d1a2f2b7a829ca561bedAffected
  • c02a81fba74fe3488ad6b08bfb5a1329005418f8 to before 92c4cfaee6872038563c5b6f2e8e613f9d84d47dAffected
LinuxLinux
  • 5.6Affected
  • before 5.6Not affected
  • 5.10.99 through 5.10.*Not affected
  • 5.15.22 through 5.15.*Not affected
  • 5.16.8 through 5.16.*Not affected
  • 5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.