CVE-2022-50774— crypto: qat - fix DMA transfer direction
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于DMA传输方向设置不当，可能导致重叠映射错误。
Affected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | d370cec3219490656d72f5ae6e5df32c113c5a44< 426d5bc089e7731e36b514d1beca19e777a2d653 |
affected |
d370cec3219490656d72f5ae6e5df32c113c5a44< 1f1ab76e251521bd2fa5244473efcf663792745d |
affected | ||
d370cec3219490656d72f5ae6e5df32c113c5a44< 429348d4f675e9eb418d0829064c4d7d06bd66a3 |
affected | ||
d370cec3219490656d72f5ae6e5df32c113c5a44< c4c9d9edf4848aed89516b23b88950b194beff6a |
affected | ||
d370cec3219490656d72f5ae6e5df32c113c5a44< cf5bb835b7c8a5fee7f26455099cca7feb57f5e9 |
affected | ||
3.17 |
affected | ||
< 3.17 |
unaffected | ||
5.10.150≤ 5.10.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-50774
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
crypto: qat - fix DMA transfer direction
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - fix DMA transfer direction
When CONFIG_DMA_API_DEBUG is selected, while running the crypto self
test on the QAT crypto algorithms, the function add_dma_entry() reports
a warning similar to the one below, saying that overlapping mappings
are not supported. This occurs in tests where the input and the output
scatter list point to the same buffers (i.e. two different scatter lists
which point to the same chunks of memory).
The logic that implements the mapping uses the flag DMA_BIDIRECTIONAL
for both the input and the output scatter lists which leads to
overlapped write mappings. These are not supported by the DMA layer.
Fix by specifying the correct DMA transfer directions when mapping
buffers. For in-place operations where the input scatter list
matches the output scatter list, buffers are mapped once with
DMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag
DMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE.
Overlapping a read mapping with a write mapping is a valid case in
dma-coherent devices like QAT.
The function that frees and unmaps the buffers, qat_alg_free_bufl()
has been changed accordingly to the changes to the mapping function.
DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported
WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270
...
Call Trace:
dma_map_page_attrs+0x82/0x2d0
? preempt_count_add+0x6a/0xa0
qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat]
qat_alg_aead_dec+0x71/0x250 [intel_qat]
crypto_aead_decrypt+0x3d/0x70
test_aead_vec_cfg+0x649/0x810
? number+0x310/0x3a0
? vsnprintf+0x2a3/0x550
? scnprintf+0x42/0x70
? valid_sg_divisions.constprop.0+0x86/0xa0
? test_aead_vec+0xdf/0x120
test_aead_vec+0xdf/0x120
alg_test_aead+0x185/0x400
alg_test+0x3d8/0x500
? crypto_acomp_scomp_free_ctx+0x30/0x30
? __schedule+0x32a/0x12a0
? ttwu_queue_wakelist+0xbf/0x110
? _raw_spin_unlock_irqrestore+0x23/0x40
? try_to_wake_up+0x83/0x570
? _raw_spin_unlock_irqrestore+0x23/0x40
? __set_cpus_allowed_ptr_locked+0xea/0x1b0
? crypto_acomp_scomp_free_ctx+0x30/0x30
cryptomgr_test+0x27/0x50
kthread+0xe6/0x110
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x1f/0x30
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于DMA传输方向设置不当，可能导致重叠映射错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50774
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50774
请登录查看更多情报信息。
Other References for CVE-2022-50774 (2)
Same Patch Batch · Linux · 2025-12-24 · 322 CVEs total
| CVE-2025-68741 | 9.8 CRITICAL | scsi: qla2xxx: Fix improper freeing of purex item |
| CVE-2023-53867 | 9.8 CRITICAL | ceph: fix potential use-after-free bug when trimming caps |
| CVE-2025-68726 | 9.8 CRITICAL | crypto: aead - Fix reqsize handling |
| CVE-2025-68745 | 9.8 CRITICAL | scsi: qla2xxx: Clear cmds after chip reset |
| CVE-2023-54094 | 9.8 CRITICAL | net: prevent skb corruption on frag list segmentation |
| CVE-2023-54090 | 9.8 CRITICAL | ixgbe: Fix panic during XDP_TX with > 64 CPUs |
| CVE-2023-54076 | 9.8 CRITICAL | smb: client: fix missed ses refcounting |
| CVE-2022-50717 | 9.8 CRITICAL | nvmet-tcp: add bounds check on Transfer Tag |
| CVE-2025-68359 | 9.8 CRITICAL | btrfs: fix double free of qgroup record after failure to add delayed ref head |
| CVE-2023-53996 | 9.3 CRITICAL | x86/sev: Make enc_dec_hypercall() accept a size instead of npages |
| CVE-2023-54071 | 8.8 HIGH | wifi: rtw88: use work to update rate to avoid RCU warning |
| CVE-2023-54120 | 8.8 HIGH | Bluetooth: Fix race condition in hidp_session_thread |
| CVE-2023-54043 | 8.8 HIGH | iommufd: Do not add the same hwpt to the ioas->hwpt_list twice |
| CVE-2022-50732 | 8.8 HIGH | staging: rtl8192u: Fix use after free in ieee80211_rx() |
| CVE-2023-54092 | 8.8 HIGH | KVM: s390: pv: fix index value of replaced ASCE |
| CVE-2023-54060 | 8.8 HIGH | iommufd: Set end correctly when doing batch carry |
| CVE-2025-68736 | 8.8 HIGH | landlock: Fix handling of disconnected directories |
| CVE-2023-54040 | 8.8 HIGH | ice: fix wrong fallback logic for FDIR |
| CVE-2023-53986 | 8.6 HIGH | mips: bmips: BCM6358: disable RAC flush for TP1 |
| CVE-2022-50746 | 8.4 HIGH | erofs: validate the extent length for uncompressed pclusters |
Showing top 20 of 322 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2022-50774
No comments yet