{
  "cveId": "CVE-2022-49407",
  "url": "https://patchblox.com/security/cve/CVE-2022-49407",
  "summary": "CVE-2022-49407 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49407, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  dlm: fix plock invalid read  This patch fixes an...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  dlm: fix plock invalid read  This patch fixes an invalid read showed by KASAN. A unlock will allocate a \u0022struct plock_op\u0022 and a followed send_op() will append it to a global send_list data structure. In some cases a followed dev_read() moves it to recv_list and dev_write() will cast it to \u0022struct plock_xop\u0022 and access fields which are only available in those structures. At this point an invalid read happens by accessing those fields.  To fix this issue the \u0022callback\u0022 field is moved to \u0022struct plock_op\u0022 to indicate that a cast to \u0022plock_xop\u0022 is allowed and does the additional \u0022plock_xop\u0022 handling if set.  Example of the KASAN output which showed the invalid read:  [ 2064.296453] ================================================================== [ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write\u002B0x52b/0x5a0 [dlm] [ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484 [ 2064.308168] [ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0\u002B #9 [ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 2064.311618] Call Trace: [ 2064.312218]  dump_stack_lvl\u002B0x56/0x7b [ 2064.313150]  print_address_description.constprop.8\u002B0x21/0x150 [ 2064.314578]  ? dev_write\u002B0x52b/0x5a0 [dlm] [ 2064.315610]  ? dev_write\u002B0x52b/0x5a0 [dlm] [ 2064.316595]  kasan_report.cold.14\u002B0x7f/0x11b [ 2064.317674]  ? dev_write\u002B0x52b/0x5a0 [dlm] [ 2064.318687]  dev_write\u002B0x52b/0x5a0 [dlm] [ 2064.319629]  ? dev_read\u002B0x4a0/0x4a0 [dlm] [ 2064.320713]  ? bpf_lsm_kernfs_init_security\u002B0x10/0x10 [ 2064.321926]  vfs_write\u002B0x17e/0x930 [ 2064.322769]  ? __fget_light\u002B0x1aa/0x220 [ 2064.323753]  ksys_write\u002B0xf1/0x1c0 [ 2064.324548]  ? __ia32_sys_read\u002B0xb0/0xb0 [ 2064.325464]  do_syscall_64\u002B0x3a/0x80 [ 2064.326387]  entry_SYSCALL_64_after_hwframe\u002B0x44/0xae [ 2064.327606] RIP: 0033:0x7f807e4ba96f [ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003C48\u003E 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48 [ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f [ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010 [ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001 [ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80 [ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001 [ 2064.342857] [ 2064.343226] Allocated by task 12438: [ 2064.344057]  kasan_save_stack\u002B0x1c/0x40 [ 2064.345079]  __kasan_kmalloc\u002B0x84/0xa0 [ 2064.345933]  kmem_cache_alloc_trace\u002B0x13b/0x220 [ 2064.346953]  dlm_posix_unlock\u002B0xec/0x720 [dlm] [ 2064.348811]  do_lock_file_wait.part.32\u002B0xca/0x1d0 [ 2064.351070]  fcntl_setlk\u002B0x281/0xbc0 [ 2064.352879]  do_fcntl\u002B0x5e4/0xfe0 [ 2064.354657]  __x64_sys_fcntl\u002B0x11f/0x170 [ 2064.356550]  do_syscall_64\u002B0x3a/0x80 [ 2064.358259]  entry_SYSCALL_64_after_hwframe\u002B0x44/0xae [ 2064.360745] [ 2064.361511] Last potentially related work creation: [ 2064.363957]  kasan_save_stack\u002B0x1c/0x40 [ 2064.365811]  __kasan_record_aux_stack\u002B0xaf/0xc0 [ 2064.368100]  call_rcu\u002B0x11b/0xf70 [ 2064.369785]  dlm_process_incoming_buffer\u002B0x47d/0xfd0 [dlm] [ 2064.372404]  receive_from_sock\u002B0x290/0x770 [dlm] [ 2064.374607]  process_recv_sockets\u002B0x32/0x40 [dlm] [ 2064.377290]  process_one_work\u002B0x9a8/0x16e0 [ 2064.379357]  worker_thread\u002B0x87/0xbf0 [ 2064.381188]  kthread\u002B0x3ac/0x490 [ 2064.383460]  ret_from_fork\u002B0x22/0x30 [ 2064.385588] [ 2064.386518] Second to last potentially related work creation: [ 2064.389219]  kasan_save_stack\u002B0x1c/0x40 [ 2064.391043]  __kasan_record_aux_stack\u002B0xaf/0xc0 [ 2064.393303]  call_rcu\u002B0x11b/0xf70 [ 2064.394885]  dlm_process_incoming_buffer\u002B0x47d/0xfd0 [dlm] [ 2064.397694]  receive_from_sock\u002B0x290/0x770  ---truncated---",
  "published": "2025-02-26T07:01:17Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00867,
  "epssPercentile": 0.58939,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49407",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49407",
      "released": "2025-02-26T07:01:17Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49407",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49407",
      "released": "2025-02-26T07:01:17Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49407",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49407",
      "released": "2025-02-26T07:01:17Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}