PT-2025-8217 · Linux+2 · Linux Kernel+2

David Laight · Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-49289

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an integer overflow in the access ok() function, which is used to check user access. Specifically, three architectures do not account for a possible overflow when checking the end of a user access against the address limit. This can lead to incorrect results when passing a negative length or another overflow. The problem arises from the lack of proper overflow handling, which can cause the function to return success when it should not.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2026-03930

CVE-2022-49289

Affected Products

Astra Linux

Debian

Linux Kernel

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49289.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49289 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49289 · Security Note
• https://git.kernel.org/stable/c/a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49289 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49289 · Security Note
• https://git.kernel.org/stable/c/99801e2f457824955da4aadaa035913a6dede03a · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49289 · Vendor Advisory
• https://git.kernel.org/stable/c/e65d28d4e9bf90a35ba79c06661a572a38391dec · Patch
• https://git.kernel.org/stable/c/222ca305c9fd39e5ed8104da25c09b2b79a516a8 · Patch
• https://bdu.fstec.ru/vul/2026-03930 · Security Note
• https://ubuntu.com/security/CVE-2022-49289 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49289 · Vendor Advisory
• https://git.kernel.org/linus/222ca305c9fd39e5ed8104da25c09b2b79a516a8 · Note