{"id":"DEBIAN-CVE-2022-49443","details":"In the Linux kernel, the following vulnerability has been resolved:  list: fix a data-race around ep-\u003erdllist  ep_poll() first calls ep_events_available() with no lock held and checks if ep-\u003erdllist is empty by list_empty_careful(), which reads rdllist-\u003eprev.  Thus all accesses to it need some protection to avoid store/load-tearing.  Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next.  Commit bf3b9f6372c4 (\"epoll: Add busy poll support to epoll with socket fds.\") added the first lockless ep_events_available(), and commit c5a282e9635e (\"fs/epoll: reduce the scope of wq lock in epoll_wait()\") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 (\"epoll: eliminate unnecessary lock for zero timeout\") made the last ep_events_available() lockless.  BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait  write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:  INIT_LIST_HEAD include/linux/list.h:38 [inline]  list_splice_init include/linux/list.h:492 [inline]  ep_start_scan fs/eventpoll.c:622 [inline]  ep_send_events fs/eventpoll.c:1656 [inline]  ep_poll fs/eventpoll.c:1806 [inline]  do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234  do_epoll_pwait fs/eventpoll.c:2268 [inline]  __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]  __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275  __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x44/0xae  read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:  list_empty_careful include/linux/list.h:329 [inline]  ep_events_available fs/eventpoll.c:381 [inline]  ep_poll fs/eventpoll.c:1797 [inline]  do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234  do_epoll_pwait fs/eventpoll.c:2268 [inline]  __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]  __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275  __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x44/0xae  value changed: 0xffff88810480c7d0 -\u003e 0xffff888103c15098  Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G        W         5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011","modified":"2026-09-01T16:05:32.136617699Z","published":"2025-02-26T07:01:20.730Z","upstream":["CVE-2022-49443"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49443"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49443.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49443.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49443.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}