{"cve":"CVE-2022-49077","nvd":{"published":"2025-02-26T07:00:45.043","modified":"2026-06-17T05:17:01.017","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\n\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\ni.e.  with an empty range.\n\nThis causes a WARN in KVM's mmu_notifier.  In the past, empty ranges\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\nlow (so far) number of unique reports, the benefits of detecting more\nbuggy callers seem to outweigh the cost of having to fix cases such as\nthis one, where userspace is doing something silly.  In this particular\ncase, an early return from move_page_tables() is enough to fix the\nissue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-193"],"references":["https://git.kernel.org/stable/c/01e67e04c28170c47700c2c226d732bbfedb1ad0","https://git.kernel.org/stable/c/04bc13dae4a27b8d030843c85ae452bb2f1d9c1f","https://git.kernel.org/stable/c/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2","https://git.kernel.org/stable/c/7d659cb1763ff17d1c6ee082fa6feb4267c7a30b","https://git.kernel.org/stable/c/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2022-49077","score":0.00253,"percentile":0.16817,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}