CVE-2022-49635: linux Out-of-bounds Write
Vulnerability summary
CVE-2022-49635 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 26-02-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/i915/selftests: fix subtraction overflow bug On some machines hole_end can be small enough to cause subtraction overflow. On the other side (addr + 2 * min_alignment) can overflow in case of mock tests. This patch should handle both cases. (cherry picked from commit ab3edc679c552a466e4bf0b11af3666008bd65a2)
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu115 products
- linuxAll versions (No fix recorded) | < 5.15.0-173.183
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1103.110
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ e1c5f754067b594de58d387aa5873dec83b6c9fd, < e8997d2d6b8d764e12489f1af2a1ce1d7384ca2a | ≥ e1c5f754067b594de58d387aa5873dec83b6c9fd, < 333991c4e66b3d4b5613315f18016da80344f659 | 4.12
- linux_kernel≥ 4.12, < 5.18.13 | 5.19:rc1 | 5.19:rc2 | 5.19:rc3 | 5.19:rc4 | 5.19:rc5 | 5.19:rc6
Debian1 product
- linux< 5.18.14-1
3 vendors · 118 products
