PT-2025-8075 · Linux+3 · Linux Kernel+3

Christophe Jaillet · Published 2022-11-15 · Updated 2025-09-29 · CVE-2022-49147

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the blk alloc ext minor() function in the Linux kernel, where the ida alloc range() function returns values from min to max, inclusive. This can cause an overflow when NR EXT DEVT is used as disk->first minor in the device add disk() function, specifically in the line ddev->devt = MKDEV(disk->major, disk->first minor). The NR EXT DEVT value is equivalent to (1 << MINORBITS), which can lead to an overflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

ALSA-2025_16880

CVE-2022-49147

RHSA-2022:8267

RHSA-2022_8267

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Red Hat

Suse

References · 1329

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49147.json · Exploit
• https://ubuntu.com/security/CVE-2022-49147 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49147 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://git.kernel.org/stable/c/d1868328dec5ae2cf210111025fcbc71f78dd5ca · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49147 · Vendor Advisory
• https://git.kernel.org/stable/c/5b9ac3727e4abb11c9cfbe9c0781fc05dfdd7cfb · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://git.kernel.org/stable/c/0f8cf8f5ccbad25ed6828875b222dbab29d5c272 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49147 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49147 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49147 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49147 · Vendor Advisory