{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-49607", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-49607", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-02-26T02:23:31.823Z", "updatedAt": "2026-05-23T15:22:30.837Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix data race between perf_event_set_output() and perf_mmap_close()\n\nYang Jihing reported a race between perf_event_set_output() and\nperf_mmap_close():\n\n\tCPU1\t\t\t\t\tCPU2\n\n\tperf_mmap_close(e2)\n\t if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0\n\t detach_rest = true\n\n\t\t\t\t\t\tioctl(e1, IOC_SET_OUTPUT, e2)\n\t\t\t\t\t\t perf_event_set_output(e1, e2)\n\n\t ...\n\t list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry)\n\t ring_buffer_attach(e, NULL);\n\t // e1 isn't yet added and\n\t // therefore not detached\n\n\t\t\t\t\t\t ring_buffer_attach(e1, e2->rb)\n\t\t\t\t\t\t list_add_rcu(&e1->rb_entry,\n\t\t\t\t\t\t\t\t &e2->rb->event_list)\n\nAfter this; e1 is attached to an unmapped rb and a subsequent\nperf_mmap() will loop forever more:\n\n\tagain:\n\t\tmutex_lock(&e->mmap_mutex);\n\t\tif (event->rb) {\n\t\t\t...\n\t\t\tif (!atomic_inc_not_zero(&e->rb->mmap_count)) {\n\t\t\t\t...\n\t\t\t\tmutex_unlock(&e->mmap_mutex);\n\t\t\t\tgoto again;\n\t\t\t}\n\t\t}\n\nThe loop in perf_mmap_close() holds e2->mmap_mutex, while the attach\nin perf_event_set_output() holds e1->mmap_mutex. As such there is no\nserialization to avoid this race.\n\nChange perf_event_set_output() to take both e1->mmap_mutex and\ne2->mmap_mutex to alleviate that problem. Additionally, have the loop\nin perf_mmap() detach the rb directly, this avoids having to wait for\nthe concurrent perf_mmap_close() to get around to doing it to make\nprogress.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "3bbd868099287ff9027db59029b502fcfa2202a0" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "f836f9ac95df15f1e0af4beb0ec20021e8c91998" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "17f5417194136517ee9bbd6511249e5310e5617c" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "98c3c8fd0d4c560e0f8335b79c407bbf7fc9462c" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "43128b3eee337824158f34da6648163d2f2fb937" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "da3c256e2d0ebc87c7db0c605c9692b6f1722074" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "a9391ff7a7c5f113d6f2bf6621d49110950de49c" }, { "version": "9bb5d40cd93c9dd4be74834b1dcb1ba03629716b", "status": "affected", "versionType": "git", "lessThan": "68e3c69803dada336893640110cb87221bb01dcf" }, { "version": "2487f0db30527032c4d56fc2d0b1a240fe89fef8", "status": "affected", "versionType": "git" }, { "version": "703197b61d05f5edae54bad3256901c5a5c8794c", "status": "affected", "versionType": "git" }, { "version": "c52217e88ae0f3a4ae00562d86e338f8f85969b4", "status": "affected", "versionType": "git" }, { "version": "3.2.49", "status": "affected", "versionType": "semver", "lessThan": "3.3" }, { "version": "3.4.52", "status": "affected", "versionType": "semver", "lessThan": "3.5" }, { "version": "3.9.8", "status": "affected", "versionType": "semver", "lessThan": "3.10" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "3.10", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "3.10" }, { "version": "4.9.325", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.9.*" }, { "version": "4.14.290", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.254", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.208", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.134", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.58", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "5.18.15", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.18.*" }, { "version": "5.19", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }