CVE-2022-49426

A flaw was found in the Linux kernel's ARM SMMU (System Memory Management Unit) driver. A local user could exploit this flaw to cause a denial of service (DoS) or potentially execute arbitrary code. This vulnerability is triggered when process memory contexts are released without maintaining an active reference, leading to a use-after-free condition where memory is accessed after being freed.

This vulnerability is rated as Moderate severity because exploitation requires local access on 64-bit ARM hardware utilizing ARM SMMUv3 with Shared Virtual Addressing (SVA) enabled. Typical enterprise deployments on other architectures such as x86_64, IBM Power, or IBM Z do not include this subsystem and remain unaffected. On supported aarch64 systems, an attacker needs privileged local access to trigger the condition during memory context teardown, limiting the blast radius primarily to local denial of service or potential privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.