In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: don't delete error page from pagecache This change is very similar to the change that was made for shmem [1], and it solves the same problem but for HugeTLBFS instead. Currently, when poison is found in a HugeTLB page, the page is removed from the page cache. That means that attempting to map or read that hugepage in the future will result in a new hugepage being allocated instead of notifying the user that the page was poisoned. As [1] states, this is effectively memory corruption. The fix is to leave the page in the page cache. If the user attempts to use a poisoned HugeTLB page with a syscall, the syscall will fail with EIO, the same error code that shmem uses. For attempts to map the page, the thread will get a BUS_MCEERR_AR SIGBUS. [1]: commit a76054266661 ("mm: shmem: don't truncate page if memory failure happens")

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hugetlbfs: don't delete error page from pagecache This change is very similar to the change that was made     for shmem [1], and it solves the same problem but for HugeTLBFS instead. Currently, when poison is found     in a HugeTLB page, the page is removed from the page cache. That means that attempting to map or read that     hugepage in the future will result in a new hugepage being allocated instead of notifying the user that     the page was poisoned. As [1] states, this is effectively memory corruption. The fix is to leave the page     in the page cache. If the user attempts to use a poisoned HugeTLB page with a syscall, the syscall will     fail with EIO, the same error code that shmem uses. For attempts to map the page, the thread will get a     BUS_MCEERR_AR SIGBUS. [1]: commit a76054266661 (mm: shmem: don't truncate page if memory failure     happens) (CVE-2022-49828)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
297598	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)	Nessus	Huawei Local Security Checks	high
297592	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1224)	Nessus	Huawei Local Security Checks	high
276115	TencentOS Server 4: kernel (TSSA-2025:0438)	Nessus	Tencent Local Security Checks	critical
245248	Linux Distros Unpatched Vulnerability : CVE-2022-49828	Nessus	Misc.	medium
170458	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-012 (ALASKERNEL-5.15-2023-012)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49828

medium

Tenable Plugins

high

high

critical

medium

high