PT-2025-8297 · Linux+1 · Linux Kernel+1

Ming Yan · Published 2022-05-06 · Updated 2025-03-02 · CVE-2022-49363

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel version 5.17

Description A bug in the F2FS file system has been identified, which can cause a panic when updating the SIT table with an invalid block address. The issue occurs when the block mapping information in the inode becomes inconsistent with the SIT table after an image has been fuzzed. This inconsistency can lead to a crash in the f2fs fallocate() function. The estimated number of potentially affected devices is not provided.

Recommendations For Linux kernel version 5.17, apply the fix by adding a sanity check on the block address in the f2fs do zero range() function to prevent the panic. As a temporary workaround, consider disabling the f2fs fallocate() function until a patch is available. Restrict access to the F2FS file system to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-02611

CVE-2022-49363

Affected Products

Astra Linux

Linux Kernel

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49363.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-49363 · Security Note
• https://git.kernel.org/stable/c/7361c9f2bd6a8f0cbb41cdea9aff04765ff23f67 · Patch
• https://git.kernel.org/stable/c/f2e1c38b5ac64eb1a16a89c52fb419409d12c25b · Patch
• https://ubuntu.com/security/CVE-2022-49363 · Vendor Advisory
• https://git.kernel.org/stable/c/a34d7b49894b0533222188a52e2958750f830efd · Patch
• https://git.kernel.org/stable/c/470493be19a5730ed432e3ac0f29a2ee7fc6c557 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49363 · Security Note
• https://git.kernel.org/stable/c/805b48b234a2803cb7daec7f158af12f0fbaefac · Patch
• https://git.kernel.org/stable/c/25f8236213a91efdf708b9d77e9e51b6fc3e141c · Patch
• https://bdu.fstec.ru/vul/2026-02611 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49363 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49363 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49363 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49363 · Vendor Advisory