{"id":"CVE-2022-47946","title":"An issue was discovered in the Linux kernel 5.10.x before 5.10.155","summary":"An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10, < 5.10.155"],"patched":["linux_kernel 5.10.155"],"published":"2022-12-23","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:16:55.997","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-47946","references":[{"url":"http://www.openwall.com/lists/oss-security/2022/12/27/1","label":"cve@mitre.org"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.161&id=0f544353fec8e717d37724d95b92538e1de79e86","label":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2022/12/22/2","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2022/12/27/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.161&id=0f544353fec8e717d37724d95b92538e1de79e86","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.openwall.com/lists/oss-security/2022/12/22/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00384,"epssPercentile":0.32316,"ingestedAt":"2026-10-14T19:49:57.528Z","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2025-04-15T13:50:17.154893Z"},"slug":"CVE-2022-47946","body":"## Overview\n\nAn issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.\n\n## Affected\n\n- `linux_kernel >= 5.10, < 5.10.155`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.10.155`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":221826,"id":"CVE-2022-47946","ts":1792035841812,"field":"exploit_available","old":"false","new":"true"}]}