PT-2025-8486 · Linux+1 · Linux Kernel+1

Published 2022-05-12 · Updated 2025-04-11 · CVE-2022-49553

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, specifically in the fs/ntfs3 module. The issue arises when the NTFS BOOT sectors per clusters field has a value greater than 0x80, which represents a shift value. To prevent negative shift values and shift values larger than the field size, validation has been added to ensure the shift value is not too large before use, considering the NTFS maximum cluster size is 2MB. This fix prevents a UBSAN error related to shift-out-of-bounds in the super.c file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Integer Overflow

Weakness Enumeration

CWE-125

CWE-190

Related Identifiers

BDU:2026-03861

CVE-2022-49553

OESA-2025-1409

OESA-2025-1410

Affected Products

Astra Linux

Linux Kernel

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49553.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-49553 · Security Note
• https://git.kernel.org/stable/c/a3b774342fa752a5290c0de36375289dfcf4a260 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21881 · Security Note
• https://git.kernel.org/stable/c/58cf68a1886d14ffdc5c892ce483a82156769e88 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-21722 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21863 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57951 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21791 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21718 · Security Note
• https://ubuntu.com/security/CVE-2022-49553 · Vendor Advisory
• https://git.kernel.org/stable/c/a2b6986316a2d106f6951e76db70fa4b2fde64a9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-21726 · Security Note