CVE-2022-49739
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
gfs2: Always check inode size of inline inodes
Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption.
The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9
- https://git.kernel.org/stable/c/46c9088cabd4d0469fdb61ac2a9c5003057fe94d
- https://git.kernel.org/stable/c/4d4cb76636134bf9a0c9c3432dae936f99954586
- https://git.kernel.org/stable/c/70376c7ff31221f1d21db5611d8209e677781d3a
- https://git.kernel.org/stable/c/7c414f6f06e9a3934901b6edc3177ae5a1e07094
- https://git.kernel.org/stable/c/d458a0984429c2d47e60254f5bc4119cbafe83a2
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-49739",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.1,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
"lessThan": "45df749f827c286adbc951f2a4865b67f0442ba9",
"versionType": "git"
},
{
"status": "affected",
"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
"lessThan": "4d4cb76636134bf9a0c9c3432dae936f99954586",
"versionType": "git"
},
{
"status": "affected",
"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
"lessThan": "7c414f6f06e9a3934901b6edc3177ae5a1e07094",
"versionType": "git"
},
{
"status": "affected",
"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
"lessThan": "46c9088cabd4d0469fdb61ac2a9c5003057fe94d",
"versionType": "git"
},
{
"status": "affected",
"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
"lessThan": "d458a0984429c2d47e60254f5bc4119cbafe83a2",
"versionType": "git"
},
{
"status": "affected",
"version": "b3b94faa5fe5968827ba0640ee9fba4b3e7f736e",
"lessThan": "70376c7ff31221f1d21db5611d8209e677781d3a",
"versionType": "git"
}
],
"programFiles": [
"fs/gfs2/aops.c",
"fs/gfs2/bmap.c",
"fs/gfs2/glops.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.280",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.240",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.177",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.93",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.11",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/gfs2/aops.c",
"fs/gfs2/bmap.c",
"fs/gfs2/glops.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-03-27T17:15:38.460",
"references": [
{
"url": "https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/46c9088cabd4d0469fdb61ac2a9c5003057fe94d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4d4cb76636134bf9a0c9c3432dae936f99954586",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/70376c7ff31221f1d21db5611d8209e677781d3a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c414f6f06e9a3934901b6edc3177ae5a1e07094",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d458a0984429c2d47e60254f5bc4119cbafe83a2",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Always check inode size of inline inodes\n\nCheck if the inode size of stuffed (inline) inodes is within the allowed\nrange when reading inodes from disk (gfs2_dinode_in()). This prevents\nus from on-disk corruption.\n\nThe two checks in stuffed_readpage() and gfs2_unstuffer_page() that just\ntruncate inline data to the maximum allowed size don't actually make\nsense, and they can be removed now as well."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: Comprobar siempre el tamaño de los inodos en línea. Se comprueba si el tamaño de los inodos rellenos (en línea) está dentro del rango permitido al leer inodos del disco (gfs2_dinode_in()). Esto evita la corrupción en disco. Las dos comprobaciones en stuffed_readpage() y gfs2_unstuffer_page(), que simplemente truncan los datos en línea al tamaño máximo permitido, no tienen sentido y también se pueden eliminar."
}
],
"lastModified": "2026-08-04T10:17:55.183",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4B4DFEC-E739-4EBC-945F-0269BB721A1A",
"versionEndExcluding": "4.19.280"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C5F51A3-AEBF-4E51-AA58-D8C8B4554A86",
"versionEndExcluding": "5.4.240",
"versionStartIncluding": "4.20"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FED8369-E7A1-48C6-9700-6ADEDEC371F7",
"versionEndExcluding": "5.10.177",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98FAC10E-42A0-4372-B1A0-A49CF672890E",
"versionEndExcluding": "5.15.93",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "535D03F4-DA02-49FE-934E-668827E6407B",
"versionEndExcluding": "6.1.11",
"versionStartIncluding": "5.16"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}