GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49133 (GCVE-0-2022-49133)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-08-12 23:58
VLAI
Title
drm/amdkfd: svm range restore work deadlock when process exit
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: svm range restore work deadlock when process exit kfd_process_notifier_release flush svm_range_restore_work which calls svm_range_list_lock_and_flush_work to flush deferred_list work, but if deferred_list work mmput release the last user, it will call exit_mmap -> notifier_release, it is deadlock with below backtrace. Move flush svm_range_restore_work to kfd_process_wq_release to avoid deadlock. Then svm_range_restore_work take task->mm ref to avoid mm is gone while validating and mapping ranges to GPU. Workqueue: events svm_range_deferred_list_work [amdgpu] Call Trace: wait_for_completion+0x94/0x100 __flush_work+0x12a/0x1e0 __cancel_work_timer+0x10e/0x190 cancel_delayed_work_sync+0x13/0x20 kfd_process_notifier_release+0x98/0x2a0 [amdgpu] __mmu_notifier_release+0x74/0x1f0 exit_mmap+0x170/0x200 mmput+0x5d/0x130 svm_range_deferred_list_work+0x104/0x230 [amdgpu] process_one_work+0x220/0x3c0
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8a7c184a16d73ab25360e0f5997f82306ff5d5a2 , < a6be83086e91891081e0589e4b4645bf4643e897 (git)
Affected: 8a7c184a16d73ab25360e0f5997f82306ff5d5a2 , < 858822905f4bf44100d63c5e22e263109976f7cb (git)
Affected: 8a7c184a16d73ab25360e0f5997f82306ff5d5a2 , < 6225bb3a88d22594aacea2485dc28ca12d596721 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.16.20 , ≤ 5.16.* (semver)
Unaffected: 5.17.3 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6be83086e91891081e0589e4b4645bf4643e897",
              "status": "affected",
              "version": "8a7c184a16d73ab25360e0f5997f82306ff5d5a2",
              "versionType": "git"
            },
            {
              "lessThan": "858822905f4bf44100d63c5e22e263109976f7cb",
              "status": "affected",
              "version": "8a7c184a16d73ab25360e0f5997f82306ff5d5a2",
              "versionType": "git"
            },
            {
              "lessThan": "6225bb3a88d22594aacea2485dc28ca12d596721",
              "status": "affected",
              "version": "8a7c184a16d73ab25360e0f5997f82306ff5d5a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "drivers/gpu/drm/amd/amdkfd/kfd_svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: svm range restore work deadlock when process exit\n\nkfd_process_notifier_release flush svm_range_restore_work\nwhich calls svm_range_list_lock_and_flush_work to flush deferred_list\nwork, but if deferred_list work mmput release the last user, it will\ncall exit_mmap -\u003e notifier_release, it is deadlock with below backtrace.\n\nMove flush svm_range_restore_work to kfd_process_wq_release to avoid\ndeadlock. Then svm_range_restore_work take task-\u003emm ref to avoid mm is\ngone while validating and mapping ranges to GPU.\n\nWorkqueue: events svm_range_deferred_list_work [amdgpu]\nCall Trace:\n wait_for_completion+0x94/0x100\n __flush_work+0x12a/0x1e0\n __cancel_work_timer+0x10e/0x190\n cancel_delayed_work_sync+0x13/0x20\n kfd_process_notifier_release+0x98/0x2a0 [amdgpu]\n __mmu_notifier_release+0x74/0x1f0\n exit_mmap+0x170/0x200\n mmput+0x5d/0x130\n svm_range_deferred_list_work+0x104/0x230 [amdgpu]\n process_one_work+0x220/0x3c0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T23:58:00.841Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6be83086e91891081e0589e4b4645bf4643e897"
        },
        {
          "url": "https://git.kernel.org/stable/c/858822905f4bf44100d63c5e22e263109976f7cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6225bb3a88d22594aacea2485dc28ca12d596721"
        }
      ],
      "title": "drm/amdkfd: svm range restore work deadlock when process exit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49133",
    "datePublished": "2025-02-26T01:55:07.722Z",
    "dateReserved": "2025-02-26T01:49:39.267Z",
    "dateUpdated": "2026-08-12T23:58:00.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49133",
      "date": "2026-09-17",
      "epss": "0.0026",
      "percentile": "0.17978"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-17T01:01:22.000Z",
      "cve": "CVE-2022-49133",
      "id": "msrc_CVE-2022-49133",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdkfd: svm range restore work deadlock when process exit",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2022-49133.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49133\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:50.590\",\"lastModified\":\"2026-08-13T00:17:29.227\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdkfd: svm range restore work deadlock when process exit\\n\\nkfd_process_notifier_release flush svm_range_restore_work\\nwhich calls svm_range_list_lock_and_flush_work to flush deferred_list\\nwork, but if deferred_list work mmput release the last user, it will\\ncall exit_mmap -\u003e notifier_release, it is deadlock with below backtrace.\\n\\nMove flush svm_range_restore_work to kfd_process_wq_release to avoid\\ndeadlock. Then svm_range_restore_work take task-\u003emm ref to avoid mm is\\ngone while validating and mapping ranges to GPU.\\n\\nWorkqueue: events svm_range_deferred_list_work [amdgpu]\\nCall Trace:\\n wait_for_completion+0x94/0x100\\n __flush_work+0x12a/0x1e0\\n __cancel_work_timer+0x10e/0x190\\n cancel_delayed_work_sync+0x13/0x20\\n kfd_process_notifier_release+0x98/0x2a0 [amdgpu]\\n __mmu_notifier_release+0x74/0x1f0\\n exit_mmap+0x170/0x200\\n mmput+0x5d/0x130\\n svm_range_deferred_list_work+0x104/0x230 [amdgpu]\\n process_one_work+0x220/0x3c0\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdkfd: bloqueo del trabajo de restauraci\u00f3n de rango de svm cuando el proceso sale kfd_process_notifier_release limpia svm_range_restore_work que llama a svm_range_list_lock_and_flush_work para limpiar el trabajo de deferred_list, pero si el trabajo de deferred_list mmput libera al \u00faltimo usuario, llamar\u00e1 a exit_mmap -\u0026gt; notifier_release, es un bloqueo con el siguiente backtrace. Mueva el vaciado de svm_range_restore_work a kfd_process_wq_release para evitar el bloqueo. Luego, svm_range_restore_work toma la referencia task-\u0026gt;mm para evitar que mm desaparezca mientras se validan y asignan rangos a la GPU. Cola de trabajo: eventos svm_range_deferred_list_work [amdgpu] Seguimiento de llamadas: wait_for_completion+0x94/0x100 __flush_work+0x12a/0x1e0 __cancel_work_timer+0x10e/0x190 cancel_delayed_work_sync+0x13/0x20 kfd_process_notifier_release+0x98/0x2a0 [amdgpu] __mmu_notifier_release+0x74/0x1f0 exit_mmap+0x170/0x200 mmput+0x5d/0x130 svm_range_deferred_list_work+0x104/0x230 [amdgpu] process_one_work+0x220/0x3c0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_process.c\",\"drivers/gpu/drm/amd/amdkfd/kfd_svm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8a7c184a16d73ab25360e0f5997f82306ff5d5a2\",\"lessThan\":\"a6be83086e91891081e0589e4b4645bf4643e897\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a7c184a16d73ab25360e0f5997f82306ff5d5a2\",\"lessThan\":\"858822905f4bf44100d63c5e22e263109976f7cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a7c184a16d73ab25360e0f5997f82306ff5d5a2\",\"lessThan\":\"6225bb3a88d22594aacea2485dc28ca12d596721\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdkfd/kfd_process.c\",\"drivers/gpu/drm/amd/amdkfd/kfd_svm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.20\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.3\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.16.20\",\"matchCriteriaId\":\"749F862D-7FFA-471F-90C6-BA6CD1F7C077\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.3\",\"matchCriteriaId\":\"AE420AC7-1E59-4398-B84F-71F4B4337762\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6225bb3a88d22594aacea2485dc28ca12d596721\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/858822905f4bf44100d63c5e22e263109976f7cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6be83086e91891081e0589e4b4645bf4643e897\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:37:55+00:00",
      "cve": "CVE-2022-49133",
      "id": "CVE-2022-49133",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdkfd: svm range restore work deadlock when process exit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49133.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.