CVE-2022-49666

powerpc/memhotplug: Add add_pages override for PPC

State
Published
Severity
Not scored
Published
Feb 26, 2025
Updated
May 23, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/memhotplug: Add add_pages override for PPC

With commit ffa0b64e3be5 ("powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit") the kernel now validate the addr against high_memory value. This results in the below BUG_ON with dax pfns.

[ 635.798741][T26531] kernel BUG at mm/page_alloc.c:5521! 1:mon> e cpu 0x1: Vector: 700 (Program Check) at [c000000007287630] pc: c00000000055ed48: free_pages.part.0+0x48/0x110 lr: c00000000053ca70: tlb_finish_mmu+0x80/0xd0 sp: c0000000072878d0 msr: 800000000282b033 current = 0xc00000000afabe00 paca = 0xc00000037ffff300 irqmask: 0x03 irq_happened: 0x05 pid = 26531, comm = 50-landscape-sy kernel BUG at :5521! Linux version 5.19.0-rc3-14659-g4ec05be7c2e1 (kvaneesh@ltc-boston8) (gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #625 SMP Thu Jun 23 00:35:43 CDT 2022 1:mon> t [link register ] c00000000053ca70 tlb_finish_mmu+0x80/0xd0 [c0000000072878d0] c00000000053ca54 tlb_finish_mmu+0x64/0xd0 (unreliable) [c000000007287900] c000000000539424 exit_mmap+0xe4/0x2a0 [c0000000072879e0] c00000000019fc1c mmput+0xcc/0x210 [c000000007287a20] c000000000629230 begin_new_exec+0x5e0/0xf40 [c000000007287ae0] c00000000070b3cc load_elf_binary+0x3ac/0x1e00 [c000000007287c10] c000000000627af0 bprm_execve+0x3b0/0xaf0 [c000000007287cd0] c000000000628414 do_execveat_common.isra.0+0x1e4/0x310 [c000000007287d80] c00000000062858c sys_execve+0x4c/0x60 [c000000007287db0] c00000000002c1b0 system_call_exception+0x160/0x2c0 [c000000007287e10] c00000000000c53c system_call_common+0xec/0x250

The fix is to make sure we update high_memory on memory hotplug. This is similar to what x86 does in commit 3072e413e305 ("mm/memory_hotplug: introduce add_pages")

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fddb88bd266f4513abab7c36bca98935c9148a98 to before 89296ac435e2cf8a5101f7fab8f0c7b754b92052Affected
  • ffa0b64e3be58519ae472ea29a1a1ad681e32f48 to before 84d146fd35a01b08e9515041de60f0f915a417d5Affected
  • ffa0b64e3be58519ae472ea29a1a1ad681e32f48 to before ac790d09885d36143076e7e02825c541e8eee899Affected
  • deab81144d5a043f42804207fb76cfbd8a806978Affected
  • d36febbcd537fcc50284e8b89609632d0146529fAffected
  • a3727c25eacd7e437c4f560957fa3a376fe93e6bAffected
  • cbc065efcba000ad8f615f506ebe61b6d3c5145bAffected
  • 5.15.34 to before 5.15.53Affected
  • 5.4.190 to before 5.5Affected
  • 5.10.111 to before 5.11Affected
  • 5.16.20 to before 5.17Affected
  • 5.17.3 to before 5.18Affected
LinuxLinux
  • 5.18Affected
  • before 5.18Not affected
  • 5.15.53 through 5.15.*Not affected
  • 5.18.10 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.