[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2022-50471":6},{"stargazers_count":4,"fetched_at":5},7,"2026-06-04T08:53:30.047Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":18,"aliases":19,"duplicate_of":9,"upstream":20,"downstream":21,"duplicates":34,"related":35,"reserved_at":9,"published_at":40,"modified_at":41,"state":42,"summary":43,"references_raw":52,"kevs":75,"epss":76,"epss_history":79,"metrics":346,"affected":352},"CVE-2022-50471","In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: Accommodate VMA splitting\n\nPrior to this commit, the gntdev driver code did not handle the\nfollowing scenario correctly with paravirtualized (PV) Xen domains:\n\n* User process sets up a gntdev mapping composed of two grant mappings\n  (i.e., two pages shared by another Xen domain).\n* User process munmap()s one of the pages.\n* User process munmap()s the remaining page.\n* User process exits.\n\nIn the scenario above, the user process would cause the kernel to log\nthe following messages in dmesg for the first munmap(), and the second\nmunmap() call would result in similar log messages:\n\n  BUG: Bad page map in process doublemap.test  pte:... pmd:...\n  page:0000000057c97bff refcount:1 mapcount:-1 \\\n    mapping:0000000000000000 index:0x0 pfn:...\n  ...\n  page dumped because: bad pte\n  ...\n  file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0\n  ...\n  Call Trace:\n   \u003CTASK>\n   dump_stack_lvl+0x46/0x5e\n   print_bad_pte.cold+0x66/0xb6\n   unmap_page_range+0x7e5/0xdc0\n   unmap_vmas+0x78/0xf0\n   unmap_region+0xa8/0x110\n   __do_munmap+0x1ea/0x4e0\n   __vm_munmap+0x75/0x120\n   __x64_sys_munmap+0x28/0x40\n   do_syscall_64+0x38/0x90\n   entry_SYSCALL_64_after_hwframe+0x61/0xcb\n   ...\n\nFor each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG)\nwould print out the following and trigger a general protection fault in\nthe affected Xen PV domain:\n\n  (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...\n  (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...\n\nAs of this writing, gntdev_grant_map structure's vma field (referred to\nas map->vma below) is mainly used for checking the start and end\naddresses of mappings. However, with split VMAs, these may change, and\nthere could be more than one VMA associated with a gntdev mapping.\nHence, remove the use of map->vma and rely on map->pages_vm_start for\nthe original start address and on (map->count \u003C\u003C PAGE_SHIFT) for the\noriginal mapping size. Let the invalidate() and find_special_page()\nhooks use these.\n\nAlso, given that there can be multiple VMAs associated with a gntdev\nmapping, move the \"mmu_interval_notifier_remove(&map->notifier)\" call to\nthe end of gntdev_put_map, so that the MMU notifier is only removed\nafter the closing of the last remaining VMA.\n\nFinally, use an atomic to prevent inadvertent gntdev mapping re-use,\ninstead of using the map->live_grants atomic counter and/or the map->vma\npointer (the latter of which is now removed). This prevents the\nuserspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the\nsame address range as a previously set up gntdev mapping. This scenario\ncan be summarized with the following call-trace, which was valid prior\nto this commit:\n\n  mmap\n    gntdev_mmap\n  mmap (repeat mmap with MAP_FIXED over the same address range)\n    gntdev_invalidate\n      unmap_grant_pages (sets 'being_removed' entries to true)\n        gnttab_unmap_refs_async\n    unmap_single_vma\n    gntdev_mmap (maps the shared pages again)\n  munmap\n    gntdev_invalidate\n      unmap_grant_pages\n        (no-op because 'being_removed' entries are true)\n    unmap_single_vma (For PV domains, Xen reports that a granted page\n      is being unmapped and triggers a general protection fault in the\n      affected domain, if Xen was built with CONFIG_DEBUG)\n\nThe fix for this last scenario could be worth its own commit, but we\nopted for a single commit, because removing the gntdev_grant_map\nstructure's vma field requires guarding the entry to gntdev_mmap(), and\nthe live_grants atomic counter is not sufficient on its own to prevent\nthe mmap() over a pre-existing mapping.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":9,"likelihood_of_exploit":9,"capec":17},"NVD-CWE-NOINFO","Insufficient Information","NVD uses this CWE ID when there is insufficient information to assign a specific CWE.","placeholder","NVD-Reserved",[],[],[],[],[22,24,26,28,30,32],{"_key":23},"SUSE-SU-2025:4320-1",{"_key":25},"SUSE-SU-2025:4111-1",{"_key":27},"SUSE-SU-2025:4139-1",{"_key":29},"SUSE-SU-2025:4149-1",{"_key":31},"DEBIAN-CVE-2022-50471",{"_key":33},"UBUNTU-CVE-2022-50471",[],[36,37,38,39],{"_key":23},{"_key":25},{"_key":27},{"_key":29},"2025-10-04T15:16:33.489Z","2026-05-11T19:20:07.965Z","Analyzed",{"cisa_kev":44,"cisa_ransomware":44,"cisa_vendor":9,"epss_severity":45,"epss_score":46,"severity":47,"severity_score":48,"severity_version":49,"severity_source":50,"severity_vector":51,"severity_status":42},false,"low",0.00017,"medium",5.5,"v3.1","nvd","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",[53,59,63,67,71],{"url":54,"sources":55,"tags":57},"https://git.kernel.org/stable/c/3c6a888e352283a14f37b9b433cd598a1a3a7dd0",[56,50],"cve.org",[58],"Patch",{"url":60,"sources":61,"tags":62},"https://git.kernel.org/stable/c/7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141",[56,50],[58],{"url":64,"sources":65,"tags":66},"https://git.kernel.org/stable/c/4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a",[56,50],[58],{"url":68,"sources":69,"tags":70},"https://git.kernel.org/stable/c/cdafa219ace013c594e2491158ad1b51f9923dde",[56,50],[58],{"url":72,"sources":73,"tags":74},"https://git.kernel.org/stable/c/5c13a4a0291b30191eff9ead8d010e1ca43a4d0c",[56,50],[58],[],{"date":77,"score":46,"percentile":78},"2026-06-03",0.04282,[80,84,88,91,94,97,99,102,105,108,111,114,117,120,123,126,129,132,135,138,141,144,147,150,153,156,159,161,164,167,170,173,176,179,182,185,188,191,195,198,201,203,206,209,212,215,218,221,224,227,230,233,236,239,242,245,248,251,254,257,260,263,266,269,271,274,277,280,282,285,288,291,294,297,299,302,305,308,311,314,316,319,323,326,329,332,335,338,340,343],{"date":81,"score":82,"percentile":83},"2025-11-04",0.00024,0.04944,{"date":85,"score":86,"percentile":87},"2025-11-05",0.00026,0.05746,{"date":89,"score":86,"percentile":90},"2025-11-06",0.05863,{"date":92,"score":86,"percentile":93},"2025-11-07",0.05875,{"date":95,"score":86,"percentile":96},"2025-11-08",0.05881,{"date":98,"score":86,"percentile":93},"2025-11-09",{"date":100,"score":86,"percentile":101},"2025-11-10",0.05852,{"date":103,"score":86,"percentile":104},"2025-11-11",0.0588,{"date":106,"score":86,"percentile":107},"2025-11-12",0.05928,{"date":109,"score":86,"percentile":110},"2025-11-13",0.05963,{"date":112,"score":86,"percentile":113},"2025-11-14",0.05995,{"date":115,"score":86,"percentile":116},"2025-11-15",0.06022,{"date":118,"score":86,"percentile":119},"2025-11-16",0.06045,{"date":121,"score":86,"percentile":122},"2025-11-17",0.06033,{"date":124,"score":86,"percentile":125},"2025-11-18",0.03598,{"date":127,"score":86,"percentile":128},"2025-11-19",0.03648,{"date":130,"score":86,"percentile":131},"2025-11-20",0.03715,{"date":133,"score":86,"percentile":134},"2025-11-21",0.06153,{"date":136,"score":86,"percentile":137},"2025-11-22",0.06102,{"date":139,"score":86,"percentile":140},"2025-11-23",0.06092,{"date":142,"score":86,"percentile":143},"2025-11-24",0.06071,{"date":145,"score":86,"percentile":146},"2025-11-25",0.06059,{"date":148,"score":86,"percentile":149},"2025-11-26",0.0608,{"date":151,"score":86,"percentile":152},"2025-11-27",0.06088,{"date":154,"score":86,"percentile":155},"2025-11-28",0.06062,{"date":157,"score":86,"percentile":158},"2025-11-29",0.06105,{"date":160,"score":86,"percentile":137},"2025-11-30",{"date":162,"score":86,"percentile":163},"2025-12-01",0.0617,{"date":165,"score":86,"percentile":166},"2025-12-02",0.06184,{"date":168,"score":86,"percentile":169},"2025-12-03",0.06198,{"date":171,"score":86,"percentile":172},"2025-12-04",0.06161,{"date":174,"score":86,"percentile":175},"2025-12-05",0.06211,{"date":177,"score":86,"percentile":178},"2025-12-06",0.06219,{"date":180,"score":86,"percentile":181},"2025-12-07",0.06226,{"date":183,"score":86,"percentile":184},"2025-12-08",0.06222,{"date":186,"score":86,"percentile":187},"2025-12-09",0.06278,{"date":189,"score":86,"percentile":190},"2025-12-10",0.0635,{"date":192,"score":193,"percentile":194},"2025-12-11",0.00027,0.06773,{"date":196,"score":193,"percentile":197},"2025-12-12",0.06778,{"date":199,"score":193,"percentile":200},"2025-12-13",0.06792,{"date":202,"score":193,"percentile":194},"2025-12-14",{"date":204,"score":193,"percentile":205},"2025-12-15",0.06739,{"date":207,"score":193,"percentile":208},"2025-12-16",0.06763,{"date":210,"score":193,"percentile":211},"2025-12-17",0.06853,{"date":213,"score":193,"percentile":214},"2025-12-18",0.06915,{"date":216,"score":193,"percentile":217},"2025-12-19",0.06911,{"date":219,"score":193,"percentile":220},"2025-12-20",0.06908,{"date":222,"score":193,"percentile":223},"2025-12-21",0.06899,{"date":225,"score":193,"percentile":226},"2025-12-22",0.06852,{"date":228,"score":193,"percentile":229},"2025-12-23",0.06845,{"date":231,"score":193,"percentile":232},"2025-12-24",0.06869,{"date":234,"score":193,"percentile":235},"2025-12-25",0.06933,{"date":237,"score":193,"percentile":238},"2025-12-26",0.06939,{"date":240,"score":193,"percentile":241},"2025-12-27",0.0695,{"date":243,"score":193,"percentile":244},"2025-12-28",0.06937,{"date":246,"score":193,"percentile":247},"2025-12-29",0.06922,{"date":249,"score":193,"percentile":250},"2025-12-30",0.06902,{"date":252,"score":193,"percentile":253},"2025-12-31",0.06942,{"date":255,"score":193,"percentile":256},"2026-01-01",0.07,{"date":258,"score":193,"percentile":259},"2026-01-02",0.06995,{"date":261,"score":193,"percentile":262},"2026-01-03",0.06988,{"date":264,"score":193,"percentile":265},"2026-01-04",0.06849,{"date":267,"score":193,"percentile":268},"2026-01-05",0.06799,{"date":270,"score":193,"percentile":200},"2026-01-06",{"date":272,"score":193,"percentile":273},"2026-01-07",0.06817,{"date":275,"score":193,"percentile":276},"2026-01-08",0.06874,{"date":278,"score":193,"percentile":279},"2026-01-09",0.0689,{"date":281,"score":193,"percentile":247},"2026-01-10",{"date":283,"score":193,"percentile":284},"2026-01-11",0.06909,{"date":286,"score":193,"percentile":287},"2026-01-12",0.06878,{"date":289,"score":193,"percentile":290},"2026-01-13",0.06866,{"date":292,"score":193,"percentile":293},"2026-01-14",0.0698,{"date":295,"score":193,"percentile":296},"2026-01-15",0.06986,{"date":298,"score":193,"percentile":256},"2026-01-16",{"date":300,"score":193,"percentile":301},"2026-01-17",0.0701,{"date":303,"score":193,"percentile":304},"2026-01-18",0.06985,{"date":306,"score":193,"percentile":307},"2026-01-19",0.06945,{"date":309,"score":193,"percentile":310},"2026-01-20",0.06904,{"date":312,"score":193,"percentile":313},"2026-01-21",0.06898,{"date":315,"score":193,"percentile":276},"2026-01-22",{"date":317,"score":193,"percentile":318},"2026-01-23",0.0694,{"date":320,"score":321,"percentile":322},"2026-01-24",0.00018,0.03501,{"date":324,"score":321,"percentile":325},"2026-01-25",0.03482,{"date":327,"score":321,"percentile":328},"2026-01-26",0.03467,{"date":330,"score":321,"percentile":331},"2026-01-27",0.03454,{"date":333,"score":321,"percentile":334},"2026-01-28",0.03439,{"date":336,"score":321,"percentile":337},"2026-01-29",0.0346,{"date":339,"score":321,"percentile":337},"2026-01-30",{"date":341,"score":321,"percentile":342},"2026-01-31",0.03449,{"date":344,"score":321,"percentile":345},"2026-02-01",0.03531,[347],{"source":50,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":348,"cvss_v4_0":9},{"baseScore":48,"baseSeverity":349,"vectorString":51,"impactScore":350,"exploitabilityScore":351},"MEDIUM",6,4.6,[353,379],{"ecosystem":9,"name":354,"vendor":355,"product":355,"cpe_part":356,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":357},"Linux","linux","a",[358,365,368,371,374,377],{"version":359,"is_range":360,"range_type":56,"version_start":361,"version_start_type":362,"version_end":363,"version_end_type":364,"fixed_in":9},">= ab31523c2fcac557226bac72cbdf5fafe01f9a26, \u003C 3c6a888e352283a14f37b9b433cd598a1a3a7dd0",true,"ab31523c2fcac557226bac72cbdf5fafe01f9a26","including","3c6a888e352283a14f37b9b433cd598a1a3a7dd0","excluding",{"version":366,"is_range":360,"range_type":56,"version_start":361,"version_start_type":362,"version_end":367,"version_end_type":364,"fixed_in":9},">= ab31523c2fcac557226bac72cbdf5fafe01f9a26, \u003C 7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141","7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141",{"version":369,"is_range":360,"range_type":56,"version_start":361,"version_start_type":362,"version_end":370,"version_end_type":364,"fixed_in":9},">= ab31523c2fcac557226bac72cbdf5fafe01f9a26, \u003C 4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a","4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a",{"version":372,"is_range":360,"range_type":56,"version_start":361,"version_start_type":362,"version_end":373,"version_end_type":364,"fixed_in":9},">= ab31523c2fcac557226bac72cbdf5fafe01f9a26, \u003C cdafa219ace013c594e2491158ad1b51f9923dde","cdafa219ace013c594e2491158ad1b51f9923dde",{"version":375,"is_range":360,"range_type":56,"version_start":361,"version_start_type":362,"version_end":376,"version_end_type":364,"fixed_in":9},">= ab31523c2fcac557226bac72cbdf5fafe01f9a26, \u003C 5c13a4a0291b30191eff9ead8d010e1ca43a4d0c","5c13a4a0291b30191eff9ead8d010e1ca43a4d0c",{"version":378,"is_range":44,"range_type":56,"version_start":378,"version_start_type":362,"version_end":378,"version_end_type":362,"fixed_in":9},"2.6.38",{"ecosystem":9,"name":380,"vendor":355,"product":381,"cpe_part":382,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":383},"linux kernel","linux_kernel","o",[384,388,392,396],{"version":385,"is_range":360,"range_type":386,"version_start":378,"version_start_type":362,"version_end":387,"version_end_type":364,"fixed_in":9},"gte2.6.38_lt5.10.152","cpe","5.10.152",{"version":389,"is_range":360,"range_type":386,"version_start":390,"version_start_type":362,"version_end":391,"version_end_type":364,"fixed_in":9},"gte5.11_lt5.15.75","5.11","5.15.75",{"version":393,"is_range":360,"range_type":386,"version_start":394,"version_start_type":362,"version_end":395,"version_end_type":364,"fixed_in":9},"gte5.16_lt5.19.17","5.16","5.19.17",{"version":397,"is_range":360,"range_type":386,"version_start":398,"version_start_type":362,"version_end":399,"version_end_type":364,"fixed_in":9},"gte6.0_lt6.0.3","6.0","6.0.3"]