GHSA-fqrh-w8r3-22q6

GHSA-fqrh-w8r3-22q6 PUBLISHED CVSS 5.599999904632568 MEDIUM

Record from GitHub Advisory Database · Published October 11, 2022

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU.

Risk scores

CVSS 3.1

5.599999904632568

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Timeline

Oct 11, 2022 CVE Published
Apr 10, 2026 Distribution Patch
Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-fqrh-w8r3-22q6
vulnetix vdb fixes GHSA-fqrh-w8r3-22q6

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-fqrh-w8r3-22q6/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →