CVE-2022-33748: Debian Linux

Medium severity, CVSS 5.6. EPSS: 0.3% chance of exploitation in the next 30 days.

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Xen Xen: from 4.0

Published 2022-10-11. Last modified 2026-06-17.