CVE-2022-49739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49739", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-27T16:39:17.986Z", "datePublished": "2025-03-27T16:42:51.609Z", "dateUpdated": "2026-08-05T08:56:11.211Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:11.211Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Always check inode size of inline inodes\n\nCheck if the inode size of stuffed (inline) inodes is within the allowed\nrange when reading inodes from disk (gfs2_dinode_in()). This prevents\nus from on-disk corruption.\n\nThe two checks in stuffed_readpage() and gfs2_unstuffer_page() that just\ntruncate inline data to the maximum allowed size don't actually make\nsense, and they can be removed now as well."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached by mounting or using a crafted GFS2 block device/image (mount \u2192 gfs2_fill_super \u2192 inode refresh \u2192 gfs2_dinode_in / iomap or directory stuffed reads); GFS2 has no network protocol front end that parses these dinode fields.\nAC:L - The attacker fully controls on-disk di_size, di_height, and related dinode fields, so an oversized stuffed inode size deterministically bypasses the missing gfs2_dinode_in() check and drives the OOB/WARN paths with no race or other condition outside attacker control.\nPR:N - The attacker only needs to supply a malicious GFS2 volume (USB/media, disk image, or shared/SAN LUN) and needs no account on the target; CAP_SYS_ADMIN required to mount (gfs2 lacks FS_USERNS_MOUNT) belongs to the victim who mounts it.\nUI:R - Exploitation requires a privileged user or automount/storage path to mount the attacker-supplied GFS2 volume so gfs2_dinode_in()/stuffed readers run; the bug is not reachable without that mount or subsequent access of the crafted inode.\nS:U - Out-of-bounds reads and WARN/withdraw occur in the host kernel on the mounting node; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - Oversized stuffed sizes make iomap_read_inline_data and especially gfs2_dir_read_stuffed() memcpy past the dinode buffer into adjacent page/kernel memory (e.g. EXHASH stuffed dirs with i_size matching BIT(i_depth)*8), which is an unbounded OOB read enabling kernel memory disclosure.\nI:N - The reachable primitive is an out-of-bounds read (and WARN/-EIO); pre-fix truncations in stuffed_readpage()/gfs2_unstuffer_page() still capped write/unstuff copies, so there is no OOB write or UAF write primitive from this defect alone.\nA:H - syzbot demonstrates WARN_ON_ONCE in iomap_read_inline_data during mount, which panics under panic_on_warn, and corrupt stuffed inodes can withdraw/fail the mount or oops on the OOB read path, fully denying availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/aops.c", "fs/gfs2/bmap.c", "fs/gfs2/glops.c"], "versions": [{"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "lessThan": "45df749f827c286adbc951f2a4865b67f0442ba9", "status": "affected", "versionType": "git"}, {"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "lessThan": "4d4cb76636134bf9a0c9c3432dae936f99954586", "status": "affected", "versionType": "git"}, {"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "lessThan": "7c414f6f06e9a3934901b6edc3177ae5a1e07094", "status": "affected", "versionType": "git"}, {"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "lessThan": "46c9088cabd4d0469fdb61ac2a9c5003057fe94d", "status": "affected", "versionType": "git"}, {"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "lessThan": "d458a0984429c2d47e60254f5bc4119cbafe83a2", "status": "affected", "versionType": "git"}, {"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "lessThan": "70376c7ff31221f1d21db5611d8209e677781d3a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/aops.c", "fs/gfs2/bmap.c", "fs/gfs2/glops.c"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.280", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.240", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.177", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.93", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.11", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "4.19.280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.4.240"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.10.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.15.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.1.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9"}, {"url": "https://git.kernel.org/stable/c/4d4cb76636134bf9a0c9c3432dae936f99954586"}, {"url": "https://git.kernel.org/stable/c/7c414f6f06e9a3934901b6edc3177ae5a1e07094"}, {"url": "https://git.kernel.org/stable/c/46c9088cabd4d0469fdb61ac2a9c5003057fe94d"}, {"url": "https://git.kernel.org/stable/c/d458a0984429c2d47e60254f5bc4119cbafe83a2"}, {"url": "https://git.kernel.org/stable/c/70376c7ff31221f1d21db5611d8209e677781d3a"}], "title": "gfs2: Always check inode size of inline inodes", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/gfs2/aops.c", "fs/gfs2/bmap.c", "fs/gfs2/glops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "45df749f827c286adbc951f2a4865b67f0442ba9", "status": "affected", "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "versionType": "git"}, {"lessThan": "4d4cb76636134bf9a0c9c3432dae936f99954586", "status": "affected", "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "versionType": "git"}, {"lessThan": "7c414f6f06e9a3934901b6edc3177ae5a1e07094", "status": "affected", "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "versionType": "git"}, {"lessThan": "46c9088cabd4d0469fdb61ac2a9c5003057fe94d", "status": "affected", "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "versionType": "git"}, {"lessThan": "d458a0984429c2d47e60254f5bc4119cbafe83a2", "status": "affected", "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "versionType": "git"}, {"lessThan": "70376c7ff31221f1d21db5611d8209e677781d3a", "status": "affected", "version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/gfs2/aops.c", "fs/gfs2/bmap.c", "fs/gfs2/glops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.280", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.240", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.177", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.93", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4B4DFEC-E739-4EBC-945F-0269BB721A1A", "versionEndExcluding": "4.19.280", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C5F51A3-AEBF-4E51-AA58-D8C8B4554A86", "versionEndExcluding": "5.4.240", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FED8369-E7A1-48C6-9700-6ADEDEC371F7", "versionEndExcluding": "5.10.177", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "98FAC10E-42A0-4372-B1A0-A49CF672890E", "versionEndExcluding": "5.15.93", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "535D03F4-DA02-49FE-934E-668827E6407B", "versionEndExcluding": "6.1.11", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Always check inode size of inline inodes\n\nCheck if the inode size of stuffed (inline) inodes is within the allowed\nrange when reading inodes from disk (gfs2_dinode_in()). This prevents\nus from on-disk corruption.\n\nThe two checks in stuffed_readpage() and gfs2_unstuffer_page() that just\ntruncate inline data to the maximum allowed size don't actually make\nsense, and they can be removed now as well."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: Comprobar siempre el tama\u00f1o de los inodos en l\u00ednea. Se comprueba si el tama\u00f1o de los inodos rellenos (en l\u00ednea) est\u00e1 dentro del rango permitido al leer inodos del disco (gfs2_dinode_in()). Esto evita la corrupci\u00f3n en disco. Las dos comprobaciones en stuffed_readpage() y gfs2_unstuffer_page(), que simplemente truncan los datos en l\u00ednea al tama\u00f1o m\u00e1ximo permitido, no tienen sentido y tambi\u00e9n se pueden eliminar."}], "id": "CVE-2022-49739", "lastModified": "2026-08-04T10:17:55.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-27T17:15:38.460", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46c9088cabd4d0469fdb61ac2a9c5003057fe94d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4d4cb76636134bf9a0c9c3432dae936f99954586"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70376c7ff31221f1d21db5611d8209e677781d3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7c414f6f06e9a3934901b6edc3177ae5a1e07094"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d458a0984429c2d47e60254f5bc4119cbafe83a2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:2458", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-284.11.1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-09T00:00:00Z"}, {"advisory": "RHSA-2023:2458", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-284.11.1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-05-09T00:00:00Z"}], "bugzilla": {"description": "kernel: gfs2: Always check inode size of inline inodes", "id": "2355515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355515"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngfs2: Always check inode size of inline inodes\nCheck if the inode size of stuffed (inline) inodes is within the allowed\nrange when reading inodes from disk (gfs2_dinode_in()). This prevents\nus from on-disk corruption.\nThe two checks in stuffed_readpage() and gfs2_unstuffer_page() that just\ntruncate inline data to the maximum allowed size don't actually make\nsense, and they can be removed now as well."], "name": "CVE-2022-49739", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49739\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49739\nhttps://lore.kernel.org/linux-cve-announce/2025032756-CVE-2022-49739-a93e@gregkh/T"], "threat_severity": "Moderate"}

{}