CVE-2022-49053: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().

Affected products

• Linux Linux Kernel: before 4.14.276 (fixed in 4.14.276); from 4.15, before 4.19.239 (fixed in 4.19.239); from 4.20, before 5.4.190 (fixed in 5.4.190); from 5.5, before 5.10.112 (fixed in 5.10.112); from 5.11, before 5.15.35 (fixed in 5.15.35); from 5.16, before 5.17.4 (fixed in 5.17.4); …

Published 2025-02-26. Last modified 2026-06-17.