LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49511: fbdev: defio: fix the pagelist corruption

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: fix the pagelist corruption Easily hit the below list corruption: == list_add corruption. prev->next should be next (ffffffffc0ceb090), but was ffffec604507edc8. (prev=ffffec604507edc8). WARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26 __list_add_valid+0x53/0x80 CPU: 65 PID: 3959 Comm: fbdev Tainted: G U RIP: 0010:__list_add_valid+0x53/0x80 Call Trace: <TASK> fb_deferred_io_mkwrite+0xea/0x150 do_page_mkwrite+0x57/0xc0 do_wp_page+0x278/0x2f0 __handle_mm_fault+0xdc2/0x1590 handle_mm_fault+0xdd/0x2c0 do_user_addr_fault+0x1d3/0x650 exc_page_fault+0x77/0x180 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x7fd98fc8fad1 == Figure out the race happens when one process is adding &page->lru into the pagelist tail in fb_deferred_io_mkwrite(), another process is re-initializing the same &page->lru in fb_deferred_io_fault(), which is not protected by the lock. This fix is to init all the page lists one time during initialization, it not only fixes the list corruption, but also avoids INIT_LIST_HEAD() redundantly. V2: change "int i" to "unsigned int i" (Geert Uytterhoeven)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49511 is a Linux kernel framebuffer deferred I/O bug. A race can corrupt an internal page list when two paths touch the same page list without the same lock. The source describes a kernel warning and list corruption, but does not state active exploitation, CVSS severity, or a confirmed business impact.

Executive priority

Treat this as a kernel maintenance item with uncertain severity. Patch through normal kernel update channels, but raise priority for systems where framebuffer paths are used or where kernel instability would disrupt operations.

Technical view

The flaw is in fbdev deferred I/O. fb_deferred_io_mkwrite() can add page->lru to a pagelist while fb_deferred_io_fault() reinitializes the same list entry without lock protection. The kernel fix initializes page lists once during setup, avoiding repeated INIT_LIST_HEAD() and preventing pagelist corruption.

Likely exposure

Exposure appears limited to Linux systems running affected 5.18-era kernels and using fbdev deferred I/O framebuffer paths. The bundle lists Linux kernel versions and stable commits, but does not identify specific distributions, appliances, or cloud images.

Exploitation context

The source bundle shows no KEV listing and no cited evidence of active exploitation. It documents a reproducible race leading to list corruption and a kernel warning. It does not provide evidence of remote attackability, privilege escalation, or public exploit availability.

Researcher notes

Evidence is limited to the CVE record and kernel stable commits. The bug is a local kernel race in fbdev defio list handling. Do not assume exploitability beyond list corruption unless additional vendor or researcher analysis confirms impact.

Mitigation direction

  • Update to a kernel build containing the referenced stable fixes.
  • Check your Linux distributor's advisory for backported kernel packages.
  • Prioritize systems that expose or depend on fbdev framebuffer functionality.
  • If patch timing is unclear, follow vendor guidance for temporary risk reduction.

Validation and detection

  • Inventory Linux kernel versions against the affected 5.18-era range in the CVE data.
  • Confirm whether fbdev deferred I/O framebuffer functionality is present or used.
  • Check vendor kernel changelogs for the referenced stable commit IDs.
  • Review kernel logs for list corruption warnings involving fb_deferred_io_* paths.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49511 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5d3aff76a3165087b0f897c0d677dfa987d9875d, 105a940416fc622406653b6fe54732897642dfbc, 105a940416fc622406653b6fe54732897642dfbcunaffected
LinuxLinux5.18, 0, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.