
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2022-49081 affects the Linux kernel's highmem subsystem, specifically in the _kmap_local_sched{in,out} functions. The vulnerability was discovered when CONFIG_DEBUG_KMAP_LOCAL is enabled, where the checks for unmapped slots in tsk->kmap_ctrl.pteval were incorrectly implemented (Kernel Git).
The vulnerability stems from a mismatch between initialization and verification methods. The slots are initialized with 0 value, but the check is performed using pte_none() instead of checking the actual value. This becomes problematic because a 0 PTE doesn't necessarily mean pte_none() will return true, particularly on architectures like xtensa where it returns false (Debian Tracker).
When triggered, the vulnerability results in runtime warnings and potential system instability. The issue manifests through warning messages in the kernel log, particularly affecting systems with CONFIG_DEBUG_KMAP_LOCAL enabled (Ubuntu Security).
The vulnerability requires CONFIG_DEBUG_KMAP_LOCAL to be enabled and primarily affects development or debugging environments. There are no known exploits in the wild, and the issue is primarily a debugging and stability concern rather than a security threat (Kernel Git).
The fix involves replacing !pte_none(pteval) with pte_val(pteval) != 0 in the affected code. This patch has been merged into the mainline kernel and backported to stable versions. Various distributions have released updated kernel packages incorporating this fix (Debian Tracker).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."