Riskcovery

CVE-2022-48887

drm/vmwgfx: Remove rcu locks from user resources

State
Published
Severity
7.8 High
Published
Aug 21, 2024
Updated
Aug 5, 2026
Reserved
Aug 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Remove rcu locks from user resources

User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources.

Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e14c02e6b6990e9f6ee18a214a22ac26bae1b25e to before 7ac9578e45b20e3f3c0c8eb71f5417a499a7226aAffected
  • e14c02e6b6990e9f6ee18a214a22ac26bae1b25e to before a309c7194e8a2f8bd4539b9449917913f6c2cd50Affected
LinuxLinux
  • 4.20Affected
  • before 4.20Not affected
  • 6.1.7 through 6.1.*Not affected
  • 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.