CVE-2022-49753 – A double increment bug in the Linux kernel's DM... (How to Fix)

Q: What is the severity of CVE-2022-49753?

CVE-2022-49753 has a CVSS score of 7.8 (HIGH). A double increment bug in the Linux kernel's DMA engine causes incorrect client counting for DMA channels, leading to resource management issues. This can result in kernel warnings, potential memory corruption, and system instability when DMA modules are loaded/unloaded repeatedly. Systems running affected Linux kernel versions with DMA functionality are vulnerable.

📋 TL;DR

A double increment bug in the Linux kernel's DMA engine causes incorrect client counting for DMA channels, leading to resource management issues. This can result in kernel warnings, potential memory corruption, and system instability when DMA modules are loaded/unloaded repeatedly. Systems running affected Linux kernel versions with DMA functionality are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific versions between initial bug introduction and patch; check kernel commit history for exact range

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires DMA functionality and module loading capability; async_tx module specifically triggers the issue.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to refcount underflow and memory corruption, potentially leading to denial of service or privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System instability, kernel warnings in logs, and potential denial of service when DMA modules are loaded/unloaded, particularly affecting systems using async_tx or similar DMA operations.

🟢

If Mitigated

Minor performance impact or kernel warnings during module operations, but no system compromise if proper kernel hardening is in place.

🌐 Internet-Facing: LOW - This is a local kernel vulnerability requiring local access or module manipulation.

🏢 Internal Only: MEDIUM - Internal users with module loading privileges could trigger the bug, potentially causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and module loading privileges; primarily a reliability issue rather than direct security bypass.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 142d644fd2cc059ffa042fbfb68e766433ef3afd, 18dd3b30d4c7e8440c63118c7a7b687372b9567f, 1b409e14b4b7af034e0450f95c165b6c5c87dbc1, 42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1, 71c601965532c38030133535f7cd93c1efa75af1

Vendor Advisory: https://git.kernel.org/stable/c/142d644fd2cc059ffa042fbfb68e766433ef3afd

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Restrict module loading

all

Prevent loading/unloading of DMA-related modules to avoid triggering the bug

echo 1 > /proc/sys/kernel/modules_disabled
chmod 600 /lib/modules/$(uname -r)/modules.dep

Disable async_tx module

all

Blacklist or prevent loading of the async_tx module which triggers the issue

echo 'blacklist async_tx' > /etc/modprobe.d/async_tx.conf
depmod -a

🧯 If You Can't Patch

Restrict module loading permissions to trusted users only
Monitor system logs for refcount underflow warnings and investigate any DMA module operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if DMA channels show incorrect counts: cat /sys/class/dma/dma0chan*/in_use

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test module load/unload of async_tx without warnings

📡 Detection & Monitoring

Log Indicators:

refcount_t: underflow; use-after-free warnings in kernel logs
dma_chan_put or dmaengine_put error messages
async_tx module load/unload patterns

Network Indicators:

None - local kernel issue

SIEM Query:

source="kernel" AND ("refcount_t: underflow" OR "dma_chan_put" OR "async_tx")

📊 Metadata

CVE ID: CVE-2022-49753

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.11% exploit probability (28.7th percentile)

Published: March 27, 2025

Last Updated: April 1, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49753, you might also want to check these: