Vulnerability-Lookup

FKIE_CVE-2022-49407

Vulnerability from fkie_nvd - Published: 2025-02-26 07:01 - Updated: 2026-10-15 22:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: dlm: fix plock invalid read This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a global send_list data structure. In some cases a followed dev_read() moves it to recv_list and dev_write() will cast it to "struct plock_xop" and access fields which are only available in those structures. At this point an invalid read happens by accessing those fields. To fix this issue the "callback" field is moved to "struct plock_op" to indicate that a cast to "plock_xop" is allowed and does the additional "plock_xop" handling if set. Example of the KASAN output which showed the invalid read: [ 2064.296453] ================================================================== [ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm] [ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484 [ 2064.308168] [ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9 [ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 2064.311618] Call Trace: [ 2064.312218] dump_stack_lvl+0x56/0x7b [ 2064.313150] print_address_description.constprop.8+0x21/0x150 [ 2064.314578] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.315610] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.316595] kasan_report.cold.14+0x7f/0x11b [ 2064.317674] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.318687] dev_write+0x52b/0x5a0 [dlm] [ 2064.319629] ? dev_read+0x4a0/0x4a0 [dlm] [ 2064.320713] ? bpf_lsm_kernfs_init_security+0x10/0x10 [ 2064.321926] vfs_write+0x17e/0x930 [ 2064.322769] ? __fget_light+0x1aa/0x220 [ 2064.323753] ksys_write+0xf1/0x1c0 [ 2064.324548] ? __ia32_sys_read+0xb0/0xb0 [ 2064.325464] do_syscall_64+0x3a/0x80 [ 2064.326387] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.327606] RIP: 0033:0x7f807e4ba96f [ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48 [ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f [ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010 [ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001 [ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80 [ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001 [ 2064.342857] [ 2064.343226] Allocated by task 12438: [ 2064.344057] kasan_save_stack+0x1c/0x40 [ 2064.345079] __kasan_kmalloc+0x84/0xa0 [ 2064.345933] kmem_cache_alloc_trace+0x13b/0x220 [ 2064.346953] dlm_posix_unlock+0xec/0x720 [dlm] [ 2064.348811] do_lock_file_wait.part.32+0xca/0x1d0 [ 2064.351070] fcntl_setlk+0x281/0xbc0 [ 2064.352879] do_fcntl+0x5e4/0xfe0 [ 2064.354657] __x64_sys_fcntl+0x11f/0x170 [ 2064.356550] do_syscall_64+0x3a/0x80 [ 2064.358259] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.360745] [ 2064.361511] Last potentially related work creation: [ 2064.363957] kasan_save_stack+0x1c/0x40 [ 2064.365811] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.368100] call_rcu+0x11b/0xf70 [ 2064.369785] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.372404] receive_from_sock+0x290/0x770 [dlm] [ 2064.374607] process_recv_sockets+0x32/0x40 [dlm] [ 2064.377290] process_one_work+0x9a8/0x16e0 [ 2064.379357] worker_thread+0x87/0xbf0 [ 2064.381188] kthread+0x3ac/0x490 [ 2064.383460] ret_from_fork+0x22/0x30 [ 2064.385588] [ 2064.386518] Second to last potentially related work creation: [ 2064.389219] kasan_save_stack+0x1c/0x40 [ 2064.391043] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.393303] call_rcu+0x11b/0xf70 [ 2064.394885] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.397694] receive_from_sock+0x290/0x770 ---truncated---

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2c55155cc365861044d9e6e80e342693e8805e33	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/42252d0d2aa9b94d168241710a761588b3959019	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/56aa8d1fbd02357f3bf81bdfba1cde87ce8402fc	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/72f2f68970f9bdc252d59e119b385a6441b0b155	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/899bc4429174861122f0c236588700a4710c1fec	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/acdad5bc9827922ec2f2e84fd198718aa8e8ab92	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e421872fa17542cf33747071fb141b0130ce9ef7	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/plock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c55155cc365861044d9e6e80e342693e8805e33",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "72f2f68970f9bdc252d59e119b385a6441b0b155",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6d",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "899bc4429174861122f0c236588700a4710c1fec",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "acdad5bc9827922ec2f2e84fd198718aa8e8ab92",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "56aa8d1fbd02357f3bf81bdfba1cde87ce8402fc",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "e421872fa17542cf33747071fb141b0130ce9ef7",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "42252d0d2aa9b94d168241710a761588b3959019",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/plock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4FC539C-0F99-4D37-BF77-607C39EF390E",
              "versionEndExcluding": "4.9.318",
              "versionStartIncluding": "2.6.22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D6823775-2653-4644-A0D4-4E6E68F10C65",
              "versionEndExcluding": "4.14.283",
              "versionStartIncluding": "4.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8CFA0F4-2D75-41F4-9753-87944A08B53B",
              "versionEndExcluding": "4.19.247",
              "versionStartIncluding": "4.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9",
              "versionEndExcluding": "5.4.198",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34ACD872-E5BC-401C-93D5-B357A62426E0",
              "versionEndExcluding": "5.10.121",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "20D41697-0E8B-4B7D-8842-F17BF2AA21E1",
              "versionEndExcluding": "5.15.46",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
              "versionEndExcluding": "5.17.14",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
              "versionEndExcluding": "5.18.3",
              "versionStartIncluding": "5.18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix plock invalid read\n\nThis patch fixes an invalid read showed by KASAN. A unlock will allocate a\n\"struct plock_op\" and a followed send_op() will append it to a global\nsend_list data structure. In some cases a followed dev_read() moves it\nto recv_list and dev_write() will cast it to \"struct plock_xop\" and access\nfields which are only available in those structures. At this point an\ninvalid read happens by accessing those fields.\n\nTo fix this issue the \"callback\" field is moved to \"struct plock_op\" to\nindicate that a cast to \"plock_xop\" is allowed and does the additional\n\"plock_xop\" handling if set.\n\nExample of the KASAN output which showed the invalid read:\n\n[ 2064.296453] ==================================================================\n[ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm]\n[ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484\n[ 2064.308168]\n[ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9\n[ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n[ 2064.311618] Call Trace:\n[ 2064.312218]  dump_stack_lvl+0x56/0x7b\n[ 2064.313150]  print_address_description.constprop.8+0x21/0x150\n[ 2064.314578]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.315610]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.316595]  kasan_report.cold.14+0x7f/0x11b\n[ 2064.317674]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.318687]  dev_write+0x52b/0x5a0 [dlm]\n[ 2064.319629]  ? dev_read+0x4a0/0x4a0 [dlm]\n[ 2064.320713]  ? bpf_lsm_kernfs_init_security+0x10/0x10\n[ 2064.321926]  vfs_write+0x17e/0x930\n[ 2064.322769]  ? __fget_light+0x1aa/0x220\n[ 2064.323753]  ksys_write+0xf1/0x1c0\n[ 2064.324548]  ? __ia32_sys_read+0xb0/0xb0\n[ 2064.325464]  do_syscall_64+0x3a/0x80\n[ 2064.326387]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.327606] RIP: 0033:0x7f807e4ba96f\n[ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48\n[ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n[ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f\n[ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010\n[ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001\n[ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80\n[ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001\n[ 2064.342857]\n[ 2064.343226] Allocated by task 12438:\n[ 2064.344057]  kasan_save_stack+0x1c/0x40\n[ 2064.345079]  __kasan_kmalloc+0x84/0xa0\n[ 2064.345933]  kmem_cache_alloc_trace+0x13b/0x220\n[ 2064.346953]  dlm_posix_unlock+0xec/0x720 [dlm]\n[ 2064.348811]  do_lock_file_wait.part.32+0xca/0x1d0\n[ 2064.351070]  fcntl_setlk+0x281/0xbc0\n[ 2064.352879]  do_fcntl+0x5e4/0xfe0\n[ 2064.354657]  __x64_sys_fcntl+0x11f/0x170\n[ 2064.356550]  do_syscall_64+0x3a/0x80\n[ 2064.358259]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.360745]\n[ 2064.361511] Last potentially related work creation:\n[ 2064.363957]  kasan_save_stack+0x1c/0x40\n[ 2064.365811]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.368100]  call_rcu+0x11b/0xf70\n[ 2064.369785]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.372404]  receive_from_sock+0x290/0x770 [dlm]\n[ 2064.374607]  process_recv_sockets+0x32/0x40 [dlm]\n[ 2064.377290]  process_one_work+0x9a8/0x16e0\n[ 2064.379357]  worker_thread+0x87/0xbf0\n[ 2064.381188]  kthread+0x3ac/0x490\n[ 2064.383460]  ret_from_fork+0x22/0x30\n[ 2064.385588]\n[ 2064.386518] Second to last potentially related work creation:\n[ 2064.389219]  kasan_save_stack+0x1c/0x40\n[ 2064.391043]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.393303]  call_rcu+0x11b/0xf70\n[ 2064.394885]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.397694]  receive_from_sock+0x290/0x770 \n---truncated---"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dlm: fix plock invalid read Este parche corrige una lectura no v\u00e1lida mostrada por KASAN. Un unlock asignar\u00e1 un \"struct plock_op\" y un send_op() seguido lo anexar\u00e1 a una estructura de datos global send_list. En algunos casos, un dev_read() seguido lo mueve a recv_list y dev_write() lo convertir\u00e1 a \"struct plock_xop\" y acceder\u00e1 a campos que solo est\u00e1n disponibles en esas estructuras. En este punto, se produce una lectura no v\u00e1lida al acceder a esos campos. Para corregir este problema, el campo \"callback\" se mueve a \"struct plock_op\" para indicar que se permite una conversi\u00f3n a \"plock_xop\" y realiza la gesti\u00f3n adicional de \"plock_xop\" si est\u00e1 configurado. Ejemplo de la salida de KASAN que mostr\u00f3 la lectura no v\u00e1lida: [ 2064.296453] ================================================================== [ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm] [ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484 [ 2064.308168] [ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9 [ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 2064.311618] Call Trace: [ 2064.312218] dump_stack_lvl+0x56/0x7b [ 2064.313150] print_address_description.constprop.8+0x21/0x150 [ 2064.314578] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.315610] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.316595] kasan_report.cold.14+0x7f/0x11b [ 2064.317674] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.318687] dev_write+0x52b/0x5a0 [dlm] [ 2064.319629] ? dev_read+0x4a0/0x4a0 [dlm] [ 2064.320713] ? bpf_lsm_kernfs_init_security+0x10/0x10 [ 2064.321926] vfs_write+0x17e/0x930 [ 2064.322769] ? __fget_light+0x1aa/0x220 [ 2064.323753] ksys_write+0xf1/0x1c0 [ 2064.324548] ? __ia32_sys_read+0xb0/0xb0 [ 2064.325464] do_syscall_64+0x3a/0x80 [ 2064.326387] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.327606] RIP: 0033:0x7f807e4ba96f [ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48 [ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f [ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010 [ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001 [ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80 [ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001 [ 2064.342857] [ 2064.343226] Allocated by task 12438: [ 2064.344057] kasan_save_stack+0x1c/0x40 [ 2064.345079] __kasan_kmalloc+0x84/0xa0 [ 2064.345933] kmem_cache_alloc_trace+0x13b/0x220 [ 2064.346953] dlm_posix_unlock+0xec/0x720 [dlm] [ 2064.348811] do_lock_file_wait.part.32+0xca/0x1d0 [ 2064.351070] fcntl_setlk+0x281/0xbc0 [ 2064.352879] do_fcntl+0x5e4/0xfe0 [ 2064.354657] __x64_sys_fcntl+0x11f/0x170 [ 2064.356550] do_syscall_64+0x3a/0x80 [ 2064.358259] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.360745] [ 2064.361511] Last potentially related work creation: [ 2064.363957] kasan_save_stack+0x1c/0x40 [ 2064.365811] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.368100] call_rcu+0x11b/0xf70 [ 2064.369785] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.372404] receive_from_sock+0x290/0x770 [dlm] [ 2064.374607] process_recv_sockets+0x32/0x40 [dlm] [ 2064.377290] process_one_work+0x9a8/0x16e0 [ 2064.379357] worker_thread+0x87/0xbf0 [ 2064.381188] kthread+0x3ac/0x490 [ 2064.383460] ret_from_fork+0x22/0x30 [ 2064.385588] [ 2064.386518] Second to last potentially related work creation: [ 2064.389219] kasan_save_stack+0x1c/0x40 [ 2064.391043] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.393303] call_rcu+0x11b/0xf70 [ 2064.394885] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.397694] receive_from_sock+0x290/0x770 ---truncated--- "
    }
  ],
  "id": "CVE-2022-49407",
  "lastModified": "2026-10-15T22:17:24.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-49407",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T21:18:00.539505Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-02-26T07:01:17.217",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2c55155cc365861044d9e6e80e342693e8805e33"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/42252d0d2aa9b94d168241710a761588b3959019"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/56aa8d1fbd02357f3bf81bdfba1cde87ce8402fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/72f2f68970f9bdc252d59e119b385a6441b0b155"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/899bc4429174861122f0c236588700a4710c1fec"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/acdad5bc9827922ec2f2e84fd198718aa8e8ab92"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e421872fa17542cf33747071fb141b0130ce9ef7"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2022-49407 (GCVE-0-2022-49407)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:12 – Updated: 2026-10-15 21:21

Title

dlm: fix plock invalid read

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:18 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/2c55155cc36586104…
https://git.kernel.org/stable/c/72f2f68970f9bdc25…
https://git.kernel.org/stable/c/5a1765adf9855cf0f…
https://git.kernel.org/stable/c/49cd9eb7b9a7b8812…
https://git.kernel.org/stable/c/899bc442917486112…
https://git.kernel.org/stable/c/acdad5bc9827922ec…
https://git.kernel.org/stable/c/56aa8d1fbd02357f3…
https://git.kernel.org/stable/c/e421872fa17542cf3…
https://git.kernel.org/stable/c/42252d0d2aa9b94d1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 2c55155cc365861044d9e6e80e342693e8805e33 (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 72f2f68970f9bdc252d59e119b385a6441b0b155 (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6d (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 899bc4429174861122f0c236588700a4710c1fec (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < acdad5bc9827922ec2f2e84fd198718aa8e8ab92 (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 56aa8d1fbd02357f3bf81bdfba1cde87ce8402fc (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < e421872fa17542cf33747071fb141b0130ce9ef7 (git) Affected: 586759f03e2e9031ac5589912a51a909ed53c30a , < 42252d0d2aa9b94d168241710a761588b3959019 (git)
Linux	Linux	Affected: 2.6.22 Unaffected: 0 , < 2.6.22 (semver) Unaffected: 4.9.318 , ≤ 4.9.* (semver) Unaffected: 4.14.283 , ≤ 4.14.* (semver) Unaffected: 4.19.247 , ≤ 4.19.* (semver) Unaffected: 5.4.198 , ≤ 5.4.* (semver) Unaffected: 5.10.121 , ≤ 5.10.* (semver) Unaffected: 5.15.46 , ≤ 5.15.* (semver) Unaffected: 5.17.14 , ≤ 5.17.* (semver) Unaffected: 5.18.3 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-49407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:18:00.539505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:21:07.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/plock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c55155cc365861044d9e6e80e342693e8805e33",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "72f2f68970f9bdc252d59e119b385a6441b0b155",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6d",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "899bc4429174861122f0c236588700a4710c1fec",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "acdad5bc9827922ec2f2e84fd198718aa8e8ab92",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "56aa8d1fbd02357f3bf81bdfba1cde87ce8402fc",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "e421872fa17542cf33747071fb141b0130ce9ef7",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            },
            {
              "lessThan": "42252d0d2aa9b94d168241710a761588b3959019",
              "status": "affected",
              "version": "586759f03e2e9031ac5589912a51a909ed53c30a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/plock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.318",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.283",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix plock invalid read\n\nThis patch fixes an invalid read showed by KASAN. A unlock will allocate a\n\"struct plock_op\" and a followed send_op() will append it to a global\nsend_list data structure. In some cases a followed dev_read() moves it\nto recv_list and dev_write() will cast it to \"struct plock_xop\" and access\nfields which are only available in those structures. At this point an\ninvalid read happens by accessing those fields.\n\nTo fix this issue the \"callback\" field is moved to \"struct plock_op\" to\nindicate that a cast to \"plock_xop\" is allowed and does the additional\n\"plock_xop\" handling if set.\n\nExample of the KASAN output which showed the invalid read:\n\n[ 2064.296453] ==================================================================\n[ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm]\n[ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484\n[ 2064.308168]\n[ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9\n[ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n[ 2064.311618] Call Trace:\n[ 2064.312218]  dump_stack_lvl+0x56/0x7b\n[ 2064.313150]  print_address_description.constprop.8+0x21/0x150\n[ 2064.314578]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.315610]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.316595]  kasan_report.cold.14+0x7f/0x11b\n[ 2064.317674]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.318687]  dev_write+0x52b/0x5a0 [dlm]\n[ 2064.319629]  ? dev_read+0x4a0/0x4a0 [dlm]\n[ 2064.320713]  ? bpf_lsm_kernfs_init_security+0x10/0x10\n[ 2064.321926]  vfs_write+0x17e/0x930\n[ 2064.322769]  ? __fget_light+0x1aa/0x220\n[ 2064.323753]  ksys_write+0xf1/0x1c0\n[ 2064.324548]  ? __ia32_sys_read+0xb0/0xb0\n[ 2064.325464]  do_syscall_64+0x3a/0x80\n[ 2064.326387]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.327606] RIP: 0033:0x7f807e4ba96f\n[ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48\n[ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n[ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f\n[ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010\n[ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001\n[ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80\n[ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001\n[ 2064.342857]\n[ 2064.343226] Allocated by task 12438:\n[ 2064.344057]  kasan_save_stack+0x1c/0x40\n[ 2064.345079]  __kasan_kmalloc+0x84/0xa0\n[ 2064.345933]  kmem_cache_alloc_trace+0x13b/0x220\n[ 2064.346953]  dlm_posix_unlock+0xec/0x720 [dlm]\n[ 2064.348811]  do_lock_file_wait.part.32+0xca/0x1d0\n[ 2064.351070]  fcntl_setlk+0x281/0xbc0\n[ 2064.352879]  do_fcntl+0x5e4/0xfe0\n[ 2064.354657]  __x64_sys_fcntl+0x11f/0x170\n[ 2064.356550]  do_syscall_64+0x3a/0x80\n[ 2064.358259]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.360745]\n[ 2064.361511] Last potentially related work creation:\n[ 2064.363957]  kasan_save_stack+0x1c/0x40\n[ 2064.365811]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.368100]  call_rcu+0x11b/0xf70\n[ 2064.369785]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.372404]  receive_from_sock+0x290/0x770 [dlm]\n[ 2064.374607]  process_recv_sockets+0x32/0x40 [dlm]\n[ 2064.377290]  process_one_work+0x9a8/0x16e0\n[ 2064.379357]  worker_thread+0x87/0xbf0\n[ 2064.381188]  kthread+0x3ac/0x490\n[ 2064.383460]  ret_from_fork+0x22/0x30\n[ 2064.385588]\n[ 2064.386518] Second to last potentially related work creation:\n[ 2064.389219]  kasan_save_stack+0x1c/0x40\n[ 2064.391043]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.393303]  call_rcu+0x11b/0xf70\n[ 2064.394885]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.397694]  receive_from_sock+0x290/0x770 \n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - GFS2 and OCFS2 use dlm_posix_unlock for posix locks and are NFS-exportable; remote NLM/NFSv4 unlock reaches vfs_lock_file \u2192 gfs2_lock/ocfs2 plock \u2192 dlm_posix_unlock, and the plock_xop path exists specifically for NFS lock support.\nAC:L - Any unlock/get that queues a small plock_op and gets a userspace reply reliably hits the out-of-bounds callback read; shaping adjacent kmalloc-96 residue so the stale callback is non-NULL is attacker-influenced heap grooming, not an uncontrollable condition.\nPR:N - A remote NFS client can issue lock/unlock on a writable exported GFS2/OCFS2 share without local shell access or capabilities; on permissive/anonymous exports no prior authenticated privileges are required.\nUI:N - No victim interaction is required once the cluster filesystem is mounted and exported; the attacker triggers the path directly with lock/unlock requests.\nS:U - Impact stays inside the host kernel security authority (memory safety / privilege escalation on that node), with no VM escape or other cross-boundary scope change.\nC:H - Unlock allocates sizeof(plock_op) (~88B) but dev_write treats it as plock_xop and reads a stale callback past the allocation; a non-NULL value enters dlm_plock_callback and further out-of-bounds pointer reads, which is defensibly a high confidentiality memory-corruption primitive.\nI:H - When the out-of-bounds callback is non-NULL, dlm_plock_callback invokes that function pointer on attacker-influenced adjacent memory, enabling control-flow hijacking / integrity compromise.\nA:H - Calling through a garbage callback or further out-of-bounds accesses can oops/panic the kernel; even the KASAN report is an invalid slab read during normal unlock completion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:03.171Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2c55155cc365861044d9e6e80e342693e8805e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/72f2f68970f9bdc252d59e119b385a6441b0b155"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee"
        },
        {
          "url": "https://git.kernel.org/stable/c/49cd9eb7b9a7b88124b31e31f8e539acaf1b3a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/899bc4429174861122f0c236588700a4710c1fec"
        },
        {
          "url": "https://git.kernel.org/stable/c/acdad5bc9827922ec2f2e84fd198718aa8e8ab92"
        },
        {
          "url": "https://git.kernel.org/stable/c/56aa8d1fbd02357f3bf81bdfba1cde87ce8402fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/e421872fa17542cf33747071fb141b0130ce9ef7"
        },
        {
          "url": "https://git.kernel.org/stable/c/42252d0d2aa9b94d168241710a761588b3959019"
        }
      ],
      "title": "dlm: fix plock invalid read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49407",
    "datePublished": "2025-02-26T02:12:31.562Z",
    "dateReserved": "2025-02-26T02:08:31.566Z",
    "dateUpdated": "2026-10-15T21:21:07.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted