LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48771: drm/vmwgfx: Fix stale file descriptors on failed usercopy

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2022-48771 is a Linux kernel vmwgfx driver flaw where a failed copy to user space can leave a stale file descriptor behind. That stale handle can point to freed kernel memory, creating use-after-free risk. Sources do not provide CVSS, confirmed exploitation, or distribution-specific package status.

Executive priority

Treat as high priority where untrusted local users or workloads can access affected Linux systems. For single-user or tightly controlled systems, handle through normal kernel patch cycles while awaiting vendor-specific severity guidance.

Technical view

In drm/vmwgfx, fd_install() occurred before the fence_rep usercopy succeeded. If the usercopy failed, put_unused_fd() did not release the installed descriptor, leaving userland with a reference to a dangling file object. Kernel stable fixes defer fd_install() until after successful usercopy.

Likely exposure

Most relevant to Linux systems running affected kernel builds with the vmwgfx driver available, especially VMware graphics environments or systems allowing local users to reach that driver. The sources do not indicate a remote attack path.

Exploitation context

The CVE text states the bug enables userland to reference a dangling file object and may lead to use-after-free exploitation scenarios. KEV is false, and the provided sources do not claim active exploitation or public weaponization.

Researcher notes

The source bundle identifies the vulnerable condition and fix pattern but lacks CVSS, CWE, exploit confirmation, and exact distribution package mappings. Avoid assuming all Linux deployments are exposed; validate driver presence, kernel lineage, and vendor backports.

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable vmwgfx fixes.
  • Check distribution vendor advisories for backported patches and package names.
  • Prioritize shared, multi-user, VDI, and VMware graphics environments.
  • Restrict untrusted local access where vmwgfx exposure cannot be promptly patched.

Validation and detection

  • Inventory Linux kernel versions and whether vmwgfx is loaded or available.
  • Compare running kernels against vendor advisories or referenced stable commits.
  • Confirm patched kernels are booted, not merely installed.
  • Review virtualization images and golden templates for outdated kernels.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48771 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc906965dee22d5e95d0651759ba107b420212a9f, c906965dee22d5e95d0651759ba107b420212a9f, c906965dee22d5e95d0651759ba107b420212a9f, c906965dee22d5e95d0651759ba107b420212a9f, c906965dee22d5e95d0651759ba107b420212a9f, c906965dee22d5e95d0651759ba107b420212a9f, c906965dee22d5e95d0651759ba107b420212a9funaffected
LinuxLinux4.14, 0, 4.14.264, 4.19.227, 5.4.175, 5.10.95, 5.15.18, 5.16.4, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.