CVE-2022-49554

zsmalloc: fix races between asynchronous zspage free and page migration

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: Oct 15, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

zsmalloc: fix races between asynchronous zspage free and page migration

The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races.

It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process).

Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	77ff465799c60294e248000cd22ae8171da3304c to before 3674d8a8dadd03a447dd21069d4dacfc3399b63bAffected 77ff465799c60294e248000cd22ae8171da3304c to before 645996efc2ae391246d595832aaa6f9d3cc338c7Affected 77ff465799c60294e248000cd22ae8171da3304c to before fc658c083904427abbf8f18280d517ee2668677cAffected 77ff465799c60294e248000cd22ae8171da3304c to before fae05b2314b147a78fbed1dc4c645d9a66313758Affected 77ff465799c60294e248000cd22ae8171da3304c to before 3ec459c8810e658401be428d3168eacfc380bdd0Affected 77ff465799c60294e248000cd22ae8171da3304c to before 8ba7b7c1dad1f6503c541778f31b33f7f62eb966Affected 77ff465799c60294e248000cd22ae8171da3304c to before c5402fb5f71f1a725f1e55d9c6799c0c7bec308fAffected 77ff465799c60294e248000cd22ae8171da3304c to before 2505a981114dcb715f8977b8433f7540854851d8Affected
LinuxLinux	4.14Affected before 4.14Not affected 4.14.282 through 4.14.Not affected 4.19.246 through 4.19.Not affected 5.4.197 through 5.4.Not affected 5.10.120 through 5.10.Not affected 5.15.45 through 5.15.Not affected 5.17.13 through 5.17.Not affected 5.18.2 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

77ff465799c60294e248000cd22ae8171da3304c to before 3674d8a8dadd03a447dd21069d4dacfc3399b63bAffected
77ff465799c60294e248000cd22ae8171da3304c to before 645996efc2ae391246d595832aaa6f9d3cc338c7Affected
77ff465799c60294e248000cd22ae8171da3304c to before fc658c083904427abbf8f18280d517ee2668677cAffected
77ff465799c60294e248000cd22ae8171da3304c to before fae05b2314b147a78fbed1dc4c645d9a66313758Affected
77ff465799c60294e248000cd22ae8171da3304c to before 3ec459c8810e658401be428d3168eacfc380bdd0Affected
77ff465799c60294e248000cd22ae8171da3304c to before 8ba7b7c1dad1f6503c541778f31b33f7f62eb966Affected
77ff465799c60294e248000cd22ae8171da3304c to before c5402fb5f71f1a725f1e55d9c6799c0c7bec308fAffected
77ff465799c60294e248000cd22ae8171da3304c to before 2505a981114dcb715f8977b8433f7540854851d8Affected

LinuxLinux

4.14Affected
before 4.14Not affected
4.14.282 through 4.14.*Not affected
4.19.246 through 4.19.*Not affected
5.4.197 through 5.4.*Not affected
5.10.120 through 5.10.*Not affected
5.15.45 through 5.15.*Not affected
5.17.13 through 5.17.*Not affected
5.18.2 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.