---
id: CVE-2022-49554
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  zsmalloc: fix races between asynchronous zspage free and page migration

  The asynchronous zspage free worker tries to lock a zspage's entire page
  list without defending…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  zsmalloc: fix races between asynchronous zspage free and page migration

  The asynchronous zspage free worker tries to lock a zspage's entire page
  list without defending…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.14, < 4.14.282'
  - 'linux_kernel >= 4.15, < 4.19.246'
  - 'linux_kernel >= 4.20, < 5.4.197'
  - 'linux_kernel >= 5.5, < 5.10.120'
  - 'linux_kernel >= 5.11, < 5.15.45'
  - 'linux_kernel >= 5.16, < 5.17.13'
  - 'linux_kernel >= 5.18, < 5.18.2'
patched:
  - linux_kernel 5.18.2
published: '2025-02-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:24.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-49554'
references:
  - url: 'https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00217
epssPercentile: 0.12042
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:18:04.837104Z'
ingestedAt: '2026-10-15T21:45:11.289Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

zsmalloc: fix races between asynchronous zspage free and page migration

The asynchronous zspage free worker tries to lock a zspage's entire page
list without defending against page migration.  Since pages which haven't
yet been locked can concurrently migrate off the zspage page list while
lock_zspage() churns away, lock_zspage() can suffer from a few different
lethal races.

It can lock a page which no longer belongs to the zspage and unsafely
dereference page_private(), it can unsafely dereference a torn pointer to
the next page (since there's a data race), and it can observe a spurious
NULL pointer to the next page and thus not lock all of the zspage's pages
(since a single page migration will reconstruct the entire page list, and
create_page_chain() unconditionally zeroes out each list pointer in the
process).

Fix the races by using migrate_read_lock() in lock_zspage() to synchronize
with page migration.

## Affected

- `linux_kernel >= 4.14, < 4.14.282`
- `linux_kernel >= 4.15, < 4.19.246`
- `linux_kernel >= 4.20, < 5.4.197`
- `linux_kernel >= 5.5, < 5.10.120`
- `linux_kernel >= 5.11, < 5.15.45`
- `linux_kernel >= 5.16, < 5.17.13`
- `linux_kernel >= 5.18, < 5.18.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.18.2`