LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49963: drm/i915/ttm: fix CCS handling

In the Linux kernel, the following vulnerability has been resolved: drm/i915/ttm: fix CCS handling Crucible + recent Mesa seems to sometimes hit: GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER) And it looks like we can also trigger this with gem_lmem_swapping, if we modify the test to use slightly larger object sizes. Looking closer it looks like we have the following issues in migrate_copy(): - We are using plain integer in various places, which we can easily overflow with a large object. - We pass the entire object size (when the src is lmem) into emit_pte() and then try to copy it, which doesn't work, since we only have a few fixed sized windows in which to map the pages and perform the copy. With an object > 8M we therefore aren't properly copying the pages. And then with an object > 64M we trigger the GEM_BUG_ON(num_ccs_blks > NUM_CCS_BLKS_PER_XFER). So it looks like our copy handling for any object > 8M (which is our CHUNK_SZ) is currently broken on DG2. Testcase: igt@gem_lmem_swapping (cherry picked from commit 8676145eb2f53a9940ff70910caf0125bd8a4bc2)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects Intel i915 graphics memory copy handling. Large graphics objects on DG2 can be copied incorrectly and may trigger a kernel assertion. The sources do not provide CVSS, CWE, or confirmed security impact, so business urgency is uncertain and should be driven by affected kernel and hardware presence.

Executive priority

Treat this as a targeted kernel maintenance item, not an emergency internet-facing exposure based on current evidence. Prioritize affected graphics workstations or GPU-enabled systems, and rely on distribution kernel updates rather than custom mitigations unless vendor guidance says otherwise.

Technical view

The flaw is in drm/i915/ttm migrate_copy CCS handling. Integer overflow risk and incorrect fixed-window copy sizing affect objects above the 8 MB chunk size, with larger objects able to hit a GEM_BUG_ON condition. Kernel stable commits are cited as fixes.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions and the Intel i915 DG2 graphics path using local memory object migration. The bundle lists Linux 5.19, 5.19.8, and 6.0 affected, but exact fixed version boundaries are not fully described.

Exploitation context

No active exploitation is stated. The CVE is not in KEV, and the description cites observed failures from Crucible with recent Mesa and an IGT gem_lmem_swapping testcase variant. Evidence supports a local graphics workload trigger, not remote exploitation.

Researcher notes

The source record lacks CVSS, CWE, exploitability analysis, and precise downstream package status. The key technical indicators are drm/i915/ttm CCS handling, migrate_copy, large object sizes, DG2, CHUNK_SZ overrun behavior, and GEM_BUG_ON for larger transfers.

Mitigation direction

  • Review vendor or distribution kernel advisories for CVE-2022-49963.
  • Prioritize updates on Linux systems with Intel i915 DG2 graphics hardware.
  • Apply kernel builds containing the referenced stable fixes when available.
  • If patch timing is unclear, consult distribution maintainers for backport status.

Validation and detection

  • Inventory Linux kernel versions across systems with Intel graphics hardware.
  • Identify hosts using i915 DG2 or local memory graphics paths.
  • Confirm whether kernel packages include the referenced stable commits.
  • Track test coverage for graphics memory migration regressions after update.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49963 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxda0595ae91da837929a00470ab40546090e5b9ae, da0595ae91da837929a00470ab40546090e5b9aeunaffected
LinuxLinux5.19, 0, 5.19.8, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.