GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49771 (GCVE-0-2022-49771)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:09 – Updated: 2026-05-11 19:06
VLAI
Title
dm ioctl: fix misbehavior if list_versions races with module loading
Summary
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading __list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" call and then will fill the space using the "dm_target_iterate(list_version_get_info, &iter_info)" call. Each of these calls locks the targets using the "down_read(&_lock)" and "up_read(&_lock)" calls, however between the first and second "dm_target_iterate" there is no lock held and the target modules can be loaded at this point, so the second "dm_target_iterate" call may need more space than what was the first "dm_target_iterate" returned. The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect. The code sets "param->data_size = param->data_start + needed" and "iter_info.end = (char *)vers+len" - "needed" is the size returned by the first dm_target_iterate call; "len" is the size of the buffer allocated by userspace. "len" may be greater than "needed"; in this case, the code will write up to "len" bytes into the buffer, however param->data_size is set to "needed", so it may write data past the param->data_size value. The ioctl interface copies only up to param->data_size into userspace, thus part of the result will be truncated. Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this guarantees that the second "dm_target_iterate" call will write only up to the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it overflows the "needed" space - in this case, userspace will allocate a larger buffer and retry. Note that there is also a bug in list_version_get_needed - we need to add "strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0c8d4112df329bf3dfbf27693f918c3b08676538 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6a818db0d5aecf80d4ba9e10ac153f60adc629ca (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3a1c35d72dc0b34d1e746ed705790c0f630aa427 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b545c0e1e4094d4de2bdfe9a3823f9154b0c0005 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f59f5a269ca5e43c567aca7f1f52500a0186e9b7 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5398b8e275bf81a2517b327d216c0f37ac9ac5ae (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4fe1ec995483737f3d2a14c3fe1d8fe634972979 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 4.9.334 , ≤ 4.9.* (semver)
Unaffected: 4.14.300 , ≤ 4.14.* (semver)
Unaffected: 4.19.267 , ≤ 4.19.* (semver)
Unaffected: 5.4.225 , ≤ 5.4.* (semver)
Unaffected: 5.10.156 , ≤ 5.10.* (semver)
Unaffected: 5.15.80 , ≤ 5.15.* (semver)
Unaffected: 6.0.10 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c8d4112df329bf3dfbf27693f918c3b08676538",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6a818db0d5aecf80d4ba9e10ac153f60adc629ca",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3a1c35d72dc0b34d1e746ed705790c0f630aa427",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b545c0e1e4094d4de2bdfe9a3823f9154b0c0005",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f59f5a269ca5e43c567aca7f1f52500a0186e9b7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5398b8e275bf81a2517b327d216c0f37ac9ac5ae",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4fe1ec995483737f3d2a14c3fe1d8fe634972979",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.334",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.334",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.300",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.267",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.225",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.156",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.80",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.10",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: fix misbehavior if list_versions races with module loading\n\n__list_versions will first estimate the required space using the\n\"dm_target_iterate(list_version_get_needed, \u0026needed)\" call and then will\nfill the space using the \"dm_target_iterate(list_version_get_info,\n\u0026iter_info)\" call. Each of these calls locks the targets using the\n\"down_read(\u0026_lock)\" and \"up_read(\u0026_lock)\" calls, however between the first\nand second \"dm_target_iterate\" there is no lock held and the target\nmodules can be loaded at this point, so the second \"dm_target_iterate\"\ncall may need more space than what was the first \"dm_target_iterate\"\nreturned.\n\nThe code tries to handle this overflow (see the beginning of\nlist_version_get_info), however this handling is incorrect.\n\nThe code sets \"param-\u003edata_size = param-\u003edata_start + needed\" and\n\"iter_info.end = (char *)vers+len\" - \"needed\" is the size returned by the\nfirst dm_target_iterate call; \"len\" is the size of the buffer allocated by\nuserspace.\n\n\"len\" may be greater than \"needed\"; in this case, the code will write up\nto \"len\" bytes into the buffer, however param-\u003edata_size is set to\n\"needed\", so it may write data past the param-\u003edata_size value. The ioctl\ninterface copies only up to param-\u003edata_size into userspace, thus part of\nthe result will be truncated.\n\nFix this bug by setting \"iter_info.end = (char *)vers + needed;\" - this\nguarantees that the second \"dm_target_iterate\" call will write only up to\nthe \"needed\" buffer and it will exit with \"DM_BUFFER_FULL_FLAG\" if it\noverflows the \"needed\" space - in this case, userspace will allocate a\nlarger buffer and retry.\n\nNote that there is also a bug in list_version_get_needed - we need to add\n\"strlen(tt-\u003ename) + 1\" to the needed size, not \"strlen(tt-\u003ename)\"."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:06:27.827Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c8d4112df329bf3dfbf27693f918c3b08676538"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a818db0d5aecf80d4ba9e10ac153f60adc629ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a1c35d72dc0b34d1e746ed705790c0f630aa427"
        },
        {
          "url": "https://git.kernel.org/stable/c/b545c0e1e4094d4de2bdfe9a3823f9154b0c0005"
        },
        {
          "url": "https://git.kernel.org/stable/c/f59f5a269ca5e43c567aca7f1f52500a0186e9b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5398b8e275bf81a2517b327d216c0f37ac9ac5ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fe1ec995483737f3d2a14c3fe1d8fe634972979"
        }
      ],
      "title": "dm ioctl: fix misbehavior if list_versions races with module loading",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49771",
    "datePublished": "2025-05-01T14:09:08.813Z",
    "dateReserved": "2025-04-16T07:17:33.805Z",
    "dateUpdated": "2026-05-11T19:06:27.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49771",
      "date": "2026-09-16",
      "epss": "0.00155",
      "percentile": "0.04978"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49771\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:00.237\",\"lastModified\":\"2026-06-17T05:19:06.477\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm ioctl: fix misbehavior if list_versions races with module loading\\n\\n__list_versions will first estimate the required space using the\\n\\\"dm_target_iterate(list_version_get_needed, \u0026needed)\\\" call and then will\\nfill the space using the \\\"dm_target_iterate(list_version_get_info,\\n\u0026iter_info)\\\" call. Each of these calls locks the targets using the\\n\\\"down_read(\u0026_lock)\\\" and \\\"up_read(\u0026_lock)\\\" calls, however between the first\\nand second \\\"dm_target_iterate\\\" there is no lock held and the target\\nmodules can be loaded at this point, so the second \\\"dm_target_iterate\\\"\\ncall may need more space than what was the first \\\"dm_target_iterate\\\"\\nreturned.\\n\\nThe code tries to handle this overflow (see the beginning of\\nlist_version_get_info), however this handling is incorrect.\\n\\nThe code sets \\\"param-\u003edata_size = param-\u003edata_start + needed\\\" and\\n\\\"iter_info.end = (char *)vers+len\\\" - \\\"needed\\\" is the size returned by the\\nfirst dm_target_iterate call; \\\"len\\\" is the size of the buffer allocated by\\nuserspace.\\n\\n\\\"len\\\" may be greater than \\\"needed\\\"; in this case, the code will write up\\nto \\\"len\\\" bytes into the buffer, however param-\u003edata_size is set to\\n\\\"needed\\\", so it may write data past the param-\u003edata_size value. The ioctl\\ninterface copies only up to param-\u003edata_size into userspace, thus part of\\nthe result will be truncated.\\n\\nFix this bug by setting \\\"iter_info.end = (char *)vers + needed;\\\" - this\\nguarantees that the second \\\"dm_target_iterate\\\" call will write only up to\\nthe \\\"needed\\\" buffer and it will exit with \\\"DM_BUFFER_FULL_FLAG\\\" if it\\noverflows the \\\"needed\\\" space - in this case, userspace will allocate a\\nlarger buffer and retry.\\n\\nNote that there is also a bug in list_version_get_needed - we need to add\\n\\\"strlen(tt-\u003ename) + 1\\\" to the needed size, not \\\"strlen(tt-\u003ename)\\\".\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm ioctl: se corrige el comportamiento incorrecto si list_versions se acelera al cargar m\u00f3dulos. __list_versions primero estimar\u00e1 el espacio requerido mediante la llamada \\\"dm_target_iterate(list_version_get_needed, \u0026amp;needed)\\\" y luego llenar\u00e1 el espacio mediante la llamada \\\"dm_target_iterate(list_version_get_info, \u0026amp;iter_info)\\\". Cada una de estas llamadas bloquea los destinos mediante las llamadas \\\"down_read(\u0026amp;_lock)\\\" y \\\"up_read(\u0026amp;_lock)\\\". Sin embargo, entre la primera y la segunda llamada \\\"dm_target_iterate\\\" no se mantiene el bloqueo y los m\u00f3dulos de destino se pueden cargar en este punto, por lo que la segunda llamada \\\"dm_target_iterate\\\" podr\u00eda necesitar m\u00e1s espacio que el devuelto por la primera llamada \\\"dm_target_iterate\\\". El c\u00f3digo intenta gestionar este desbordamiento (v\u00e9ase el comienzo de list_version_get_info), pero esta gesti\u00f3n es incorrecta. El c\u00f3digo establece \\\"param-\u0026gt;data_size = param-\u0026gt;data_start + needed\\\" y \\\"iter_info.end = (char *)vers+len\\\": \\\"needed\\\" es el tama\u00f1o devuelto por la primera llamada a dm_target_iterate; \\\"len\\\" es el tama\u00f1o del b\u00fafer asignado por el espacio de usuario. \\\"len\\\" puede ser mayor que \\\"needed\\\"; en este caso, el c\u00f3digo escribir\u00e1 hasta \\\"len\\\" bytes en el b\u00fafer; sin embargo, param-\u0026gt;data_size se establece en \\\"needed\\\", por lo que podr\u00eda escribir datos que superen el valor de param-\u0026gt;data_size. La interfaz ioctl solo copia hasta param-\u0026gt;data_size en el espacio de usuario, por lo que parte del resultado se truncar\u00e1. Corrija este error estableciendo \\\"iter_info.end = (char *)vers + needed;\\\" Esto garantiza que la segunda llamada \\\"dm_target_iterate\\\" solo escriba hasta el b\u00fafer necesario y finalice con \\\"DM_BUFFER_FULL_FLAG\\\" si se desborda dicho espacio. En este caso, el espacio de usuario asignar\u00e1 un b\u00fafer mayor y reintentar\u00e1. Tenga en cuenta que tambi\u00e9n hay un error en list_version_get_needed: debemos agregar \\\"strlen(tt-\u0026gt;name) + 1\\\" al tama\u00f1o necesario, no \\\"strlen(tt-\u0026gt;name)\\\".\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm-ioctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"0c8d4112df329bf3dfbf27693f918c3b08676538\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"6a818db0d5aecf80d4ba9e10ac153f60adc629ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3a1c35d72dc0b34d1e746ed705790c0f630aa427\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b545c0e1e4094d4de2bdfe9a3823f9154b0c0005\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"f59f5a269ca5e43c567aca7f1f52500a0186e9b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"5398b8e275bf81a2517b327d216c0f37ac9ac5ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"4fe1ec995483737f3d2a14c3fe1d8fe634972979\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm-ioctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.334\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.300\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.267\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.225\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.156\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.80\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.10\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.334\",\"matchCriteriaId\":\"65416FEB-3A76-4DA9-A96A-1479EC77AFB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.300\",\"matchCriteriaId\":\"424802D2-E9E7-48A9-AD6F-DF2227B3D83A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.267\",\"matchCriteriaId\":\"A5C69A12-68E2-400E-9A5A-375A673C8402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.225\",\"matchCriteriaId\":\"94D21814-3051-4860-AB06-C7880A3D4933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.156\",\"matchCriteriaId\":\"E2152F3D-E6D3-405D-B0BE-911B8B6E2EE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.80\",\"matchCriteriaId\":\"51BBEF3B-79F5-4D4C-ADBA-F34DA0E2465C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.10\",\"matchCriteriaId\":\"64F9ADD1-3ADB-4D66-A00F-4A83010B05F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c8d4112df329bf3dfbf27693f918c3b08676538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a1c35d72dc0b34d1e746ed705790c0f630aa427\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4fe1ec995483737f3d2a14c3fe1d8fe634972979\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5398b8e275bf81a2517b327d216c0f37ac9ac5ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a818db0d5aecf80d4ba9e10ac153f60adc629ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b545c0e1e4094d4de2bdfe9a3823f9154b0c0005\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f59f5a269ca5e43c567aca7f1f52500a0186e9b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:17:25+00:00",
      "cve": "CVE-2022-49771",
      "id": "CVE-2022-49771",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm ioctl: fix misbehavior if list_versions races with module loading",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49771.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:25:47Z",
      "cve": "CVE-2022-49771",
      "id": "CVE-2022-49771",
      "initial_release_date": "2025-05-07T02:20:15Z",
      "product_status:known_affected": "460",
      "product_status:known_not_affected": "172",
      "product_status:recommended": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49771",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49771.json",
      "version": "52"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.