{
  "cveId": "CVE-2022-49560",
  "url": "https://patchblox.com/security/cve/CVE-2022-49560",
  "summary": "CVE-2022-49560 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49560, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  exfat: check if cluster num is valid  Syzbot rep...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  exfat: check if cluster num is valid  Syzbot reported slab-out-of-bounds read in exfat_clear_bitmap. This was triggered by reproducer calling truncute with size 0, which causes the following trace:  BUG: KASAN: slab-out-of-bounds in exfat_clear_bitmap\u002B0x147/0x490 fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz-executor251/365  Call Trace:  __dump_stack lib/dump_stack.c:77 [inline]  dump_stack_lvl\u002B0x1e2/0x24b lib/dump_stack.c:118  print_address_description\u002B0x81/0x3c0 mm/kasan/report.c:233  __kasan_report mm/kasan/report.c:419 [inline]  kasan_report\u002B0x1a4/0x1f0 mm/kasan/report.c:436  __asan_report_load8_noabort\u002B0x14/0x20 mm/kasan/report_generic.c:309  exfat_clear_bitmap\u002B0x147/0x490 fs/exfat/balloc.c:174  exfat_free_cluster\u002B0x25a/0x4a0 fs/exfat/fatent.c:181  __exfat_truncate\u002B0x99e/0xe00 fs/exfat/file.c:217  exfat_truncate\u002B0x11b/0x4f0 fs/exfat/file.c:243  exfat_setattr\u002B0xa03/0xd40 fs/exfat/file.c:339  notify_change\u002B0xb76/0xe10 fs/attr.c:336  do_truncate\u002B0x1ea/0x2d0 fs/open.c:65  Move the is_valid_cluster() helper from fatent.c to a common header to make it reusable in other *.c files. And add is_valid_cluster() to validate if cluster number is within valid range in exfat_clear_bitmap() and exfat_set_bitmap().",
  "published": "2025-02-26T07:01:31Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00291,
  "epssPercentile": 0.21825,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.2-1",
      "fix": "DEBIAN-CVE-2022-49560",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49560",
      "released": "2025-02-26T07:01:31Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.2-1",
      "fix": "DEBIAN-CVE-2022-49560",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49560",
      "released": "2025-02-26T07:01:31Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.2-1",
      "fix": "DEBIAN-CVE-2022-49560",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49560",
      "released": "2025-02-26T07:01:31Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}