CVE-2022-49335 — drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.

Back Back to CVE browser

MEDIUM

drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.

Published Feb 26, 2025

5.5

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

Submitting a cs with 0 chunks, causes an oops later, found trying to execute the wrong userspace driver.

MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo

[172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [172536.665188] #PF: supervisor read access in kernel mode [172536.665189] #PF: error_code(0x0000) - not-present page [172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 [172536.665195] Oops: 0000 [#1] SMP NOPTI [172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS [172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 [172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] [172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 [172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 [172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 [172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 [172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40 [172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28 [172536.665283] FS: 00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000 [172536.665284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0 [172536.665287] Call Trace: [172536.665322] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] [172536.665332] drm_ioctl_kernel+0xaa/0xf0 [drm] [172536.665338] drm_ioctl+0x201/0x3b0 [drm] [172536.665369] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] [172536.665372] ? selinux_file_ioctl+0x135/0x230 [172536.665399] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] [172536.665403] __x64_sys_ioctl+0x83/0xb0 [172536.665406] do_syscall_64+0x33/0x40 [172536.665409] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.2
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.2
- Version
  4.14.283
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.247
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.318
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.121
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.46
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.17.14
  Status
  unaffected
  Constraints
  <=5.17.*
- Version
  5.18.3
  Status
  unaffected
  Constraints
  <=5.18.*
- Version
  5.19
  Status
  unaffected
  Constraints
  <=*
- Version
  5.4.198
  Status
  unaffected
  Constraints
  <=5.4.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
4.2	affected	-
0	unaffected	<4.2
4.14.283	unaffected	<=4.14.*
4.19.247	unaffected	<=4.19.*
4.9.318	unaffected	<=4.9.*
5.10.121	unaffected	<=5.10.*
5.15.46	unaffected	<=5.15.*
5.17.14	unaffected	<=5.17.*
5.18.3	unaffected	<=5.18.*
5.19	unaffected	<=*
5.4.198	unaffected	<=5.4.*

Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.28% 0.00278

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00278

Score over time

2025–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (4 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.28% (0.00278)	18.33th	v5 (v2026.06.15)
Jun 15, 2026	0.26% (0.00255)	16.62th	v5 (v2026.06.15)
Mar 17, 2025	0.01% (0.00015)	1.62th	v4 (v2025.03.14)
Feb 27, 2025	0.04% (0.00044)	15.63th	v3 (v2023.03.01)

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (14)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-49335		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2347897		Issue Tracking
https://git.kernel.org/stable/c/15c3bcc9b5349d40207e5f8d4d799b8b4b7d13b8		Patch
https://git.kernel.org/stable/c/20b947e5a3c74c5084d661c097517a554989d462		Patch
https://git.kernel.org/stable/c/31ab27b14daaa75541a415c6794d6f3567fea44a		Patch
https://git.kernel.org/stable/c/70276460e914d560e96bfc208695a872fe9469c9		Patch
https://git.kernel.org/stable/c/7086a23890d255bb5761604e39174b20d06231a4		Patch
https://git.kernel.org/stable/c/8189f44270db1be78169e11eec51a3eeb980bc63		Patch
https://git.kernel.org/stable/c/aa25acbe96692e4bf8482311c293f72d8c6034c0		Patch
https://git.kernel.org/stable/c/be585921f29df5422a39c952d188b418ad48ffab		Patch
https://git.kernel.org/stable/c/c12984cdb077b9042d2dc20ca18cb16a87bcc774		Patch
https://lore.kernel.org/linux-cve-announce/2025022640-CVE-2022-49335-ae62@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49335
https://www.cve.org/CVERecord?id=CVE-2022-49335