PT-2025-8327 · Linux+1 · Linux Kernel+1

Jan Jablonsky · Published 2022-05-19 · Updated 2026-05-26 · CVE-2022-49393

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the incorrect use of a list iterator in the fastrpc req mem unmap impl function. The list iterator value 'map' is always set and non-NULL by list for each entry(), making it incorrect to assume it will be NULL if the list is empty. This leads to a kernel crash with a trace indicating an inability to handle kernel access to user memory outside uaccess routines. The crash occurs in the fastrpc map create function, which is called by fastrpc req mem map, fastrpc device ioctl, and ultimately by the arm64 sys ioctl system call.

Recommendations To fix the bug, use a new variable 'iter' as the list iterator, while using the original variable 'map' as a dedicated pointer to point to the found element. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

CWE-670

Related Identifiers

BDU:2026-04310

CVE-2022-49393

Affected Products

Astra Linux

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49393.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49393 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49393 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-49393 · Vendor Advisory
• https://git.kernel.org/stable/c/c5c07c5958cf0c9af6e76813e6de15d42ee49822 · Patch
• https://bdu.fstec.ru/vul/2026-04310 · Security Note
• https://ubuntu.com/security/CVE-2022-49393 · Vendor Advisory
• https://git.kernel.org/stable/c/2d12905aad462383f4e7a5fdb024d2b7ae2d10cf · Patch
• https://cve.org/CVERecord?id=CVE-2022-49393 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49393 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49393 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49393 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://t.me/cveNotify/136062 · Telegram Post
• https://lore.kernel.org/linux-cve-announce/2025022649-CVE-2022-49393-dd81@gregkh · Note