---
id: CVE-2022-47946
title: An issue was discovered in the Linux kernel 5.10.x before 5.10.155
summary: >-
  An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A
  use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to
  crash the kernel, resulting in denial of service. finish_wait can be skipped.
  An attack can …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.10, < 5.10.155'
patched:
  - linux_kernel 5.10.155
published: '2022-12-23'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:16:55.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-47946'
references:
  - url: 'http://www.openwall.com/lists/oss-security/2022/12/27/1'
    label: cve@mitre.org
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.161&id=0f544353fec8e717d37724d95b92538e1de79e86
    label: cve@mitre.org
  - url: 'https://www.openwall.com/lists/oss-security/2022/12/22/2'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2022/12/27/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.10.161&id=0f544353fec8e717d37724d95b92538e1de79e86
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.openwall.com/lists/oss-security/2022/12/22/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00384
epssPercentile: 0.32316
ingestedAt: '2026-10-14T19:49:57.528Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-04-15T13:50:17.154893Z'
---

## Overview

An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.

## Affected

- `linux_kernel >= 5.10, < 5.10.155`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.10.155`