{"id":"CVE-2022-4696","details":"There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current-\u003ensproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current-\u003ensproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above\n","aliases":["A-264692298","ASB-A-264692298"],"modified":"2026-03-13T06:47:08.473334Z","published":"2023-01-11T13:15:09.307Z","references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230223-0003/"},{"type":"FIX","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a"},{"type":"EVIDENCE","url":"https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-4696.json","unresolved_ranges":[{"events":[{"introduced":"5.10"},{"fixed":"5.12"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}