{
  "cveId": "CVE-2022-49526",
  "url": "https://patchblox.com/security/cve/CVE-2022-49526",
  "summary": "CVE-2022-49526 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49526, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  md/bitmap: don\u0027t set sb values if can\u0027t pass san...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  md/bitmap: don\u0027t set sb values if can\u0027t pass sanity check  If bitmap area contains invalid data, kernel will crash then mdadm triggers \u0022Segmentation fault\u0022. This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info. But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed.  How to trigger: (faulty injection)  dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss echo aaa \u003E magic.txt  == below modifying slot 2 bitmap data == dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 \u003C== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 \u003C== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb  == kernel crashes. mdadm outputs \u0022Segmentation fault\u0022 ==  Reason of kernel crash:  In md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn\u0027t block chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T() trigger \u0022divide error\u0022.  Crash log:  kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: md_bitmap_copy_from_slot can\u0027t get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996) kernel: RIP: 0010:md_bitmap_create\u002B0x1d1/0x850 [md_mod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ... ... kernel: Call Trace: kernel:  ? dlm_lock_sync\u002B0xd0/0xd0 [md_cluster 77fe..7a0] kernel:  md_bitmap_copy_from_slot\u002B0x2c/0x290 [md_mod 24ea..d3a] kernel:  load_bitmaps\u002B0xec/0x210 [md_cluster 77fe..7a0] kernel:  md_bitmap_load\u002B0x81/0x1e0 [md_mod 24ea..d3a] kernel:  do_md_run\u002B0x30/0x100 [md_mod 24ea..d3a] kernel:  md_ioctl\u002B0x1290/0x15a0 [md_mod 24ea....d3a] kernel:  ? mddev_unlock\u002B0xaa/0x130 [md_mod 24ea..d3a] kernel:  ? blkdev_ioctl\u002B0xb1/0x2b0 kernel:  block_ioctl\u002B0x3b/0x40 kernel:  __x64_sys_ioctl\u002B0x7f/0xb0 kernel:  do_syscall_64\u002B0x59/0x80 kernel:  ? exit_to_user_mode_prepare\u002B0x1ab/0x230 kernel:  ? syscall_exit_to_user_mode\u002B0x18/0x40 kernel:  ? do_syscall_64\u002B0x69/0x80 kernel:  entry_SYSCALL_64_after_hwframe\u002B0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:md_bitmap_create\u002B0x1d1/0x850 [md_mod]",
  "published": "2025-02-26T07:01:28Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00318,
  "epssPercentile": 0.24953,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49526",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49526",
      "released": "2025-02-26T07:01:28Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49526",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49526",
      "released": "2025-02-26T07:01:28Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49526",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49526",
      "released": "2025-02-26T07:01:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}