Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can corrupt how huge-page memory markers are handled during userfaultfd write-protection changes. In the reported scenario, it led to a kernel BUG and system crash. Exposure appears narrow and tied to huge pages, userfaultfd write-protect, and virtualization-style workloads such as QEMU snapshots.
Executive priority
Schedule remediation with normal kernel maintenance urgency, faster for virtualization platforms using huge pages and snapshot features. There is no source-backed evidence of active exploitation, but a kernel crash on affected infrastructure can still disrupt hosted workloads.
Technical view
hugetlb_change_protection() mishandled uffd-wp PTE markers when write-protecting again or unprotecting. A stale or wrongly modified marker could later be treated as a present PTE mapping garbage, triggering VM_BUG_ON in hugepage unmap/fallocate paths. Linux 5.19 through listed 6.1.8/6.2 ranges are marked affected.
Likely exposure
Most relevant to Linux systems running huge pages with userfaultfd write-protect, especially virtualization or memory-management workloads using QEMU, virtio-mem, background snapshots, hugetlbfs, or memfd-backed huge pages. General-purpose systems without these features are less likely exposed.
Exploitation context
The source describes a researcher-triggered kernel crash condition, not public exploitation in the wild. The CVE is not marked KEV, and no cited source claims active exploitation. Impact evidence supports potential local denial of service under specific memory-management conditions.
Researcher notes
Evidence is based on kernel patch text and CVE metadata. The bug requires a specific interaction between hugetlb PTE markers and uffd-wp state transitions. Severity, CVSS, CWE, and broad exploitability are not provided in the bundle.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes or distribution backports.
- Prioritize hosts using hugetlb, userfaultfd write-protect, QEMU, virtio-mem, or snapshot tooling.
- Check vendor advisories for exact package versions and supported upgrade paths.
- Where feasible, reduce reliance on affected huge-page userfaultfd workflows until patched.
Validation and detection
- Inventory Linux kernel versions against the affected 5.19, 6.1.8, and 6.2 ranges.
- Confirm whether vendor kernels include the referenced stable commits or equivalent backports.
- Identify workloads using hugetlbfs, memfd-backed huge pages, userfaultfd write-protect, or QEMU snapshots.
- Review kernel crash records for VM_BUG_ON traces involving hugepage unmap or fallocate paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49760 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6062c992e912df1eedad52cf64efb3d48e8d35c5CVE reference, Linux
- https://git.kernel.org/stable/c/0e678153f5be7e6c8d28835f5a678618da4b7a9cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.