CVE-2022-49935

A flaw was found in the Linux kernel's DMA-BUF (Direct Memory Access buffer) subsystem. When handling synchronization fences—mechanisms used to coordinate memory operations between hardware and software—the kernel failed to verify whether a newly added fence occurred after existing ones. A local attacker could exploit this flaw through user-space interfaces to cause a use-after-free memory condition, potentially leading to privilege escalation or a system crash.

This vulnerability is rated as Moderate impact because exploitation requires local access and precise timing during DMA buffer fence synchronization, limiting reliability. In typical Red Hat Enterprise Linux deployments, access to the underlying direct memory access interfaces is restricted to local users interacting with specific accelerated graphics or device subsystems. Consequently, while an authenticated local attacker with device access could potentially trigger a kernel crash or escalate privileges via memory corruption, the preconditions and execution complexity constrain the overall risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.