PT-2025-18479 · Linux+2 · Linux Kernel+2

Published 2022-09-11 · Updated 2025-06-30 · CVE-2022-49762

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an integer overflow bug in the Linux kernel when iterating over ATTR RECORDs in the mft record. This occurs because the kernel calculates the end address of the current ATTR RECORD using the length field, which can trigger an overflow. On 32-bit systems, this may lead to an infinite loop. The problem arises from the line of code a = (ATTR RECORD*)((u8*)a + le32 to cpu(a->length)), where a->length is the length field of the current ATTR RECORD.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2026-02630

CVE-2022-49762

SUSE-SU-2025:01966-1

SUSE-SU-2025:02173-1

SUSE-SU-2025:2173-1

SUSE-SU-2025_02173-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 435

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49762.json · Exploit
• https://git.kernel.org/stable/c/5559eb5809353a83a40a1e4e7f066431c7b83020 · Patch
• https://git.kernel.org/stable/c/785b2af9654b8beac55644e36da0085c5d776361 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49762 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02630 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49762 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49762 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49762 · Security Note
• https://git.kernel.org/stable/c/86f36de14dce5802856bb7a5921d74439db00b64 · Patch
• https://git.kernel.org/stable/c/45683723f6b53e39e8a4cec0894e61fd6ec71989 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02173-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49762 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01966-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49762 · Vendor Advisory