CVE-2022-49395: um: Fix out-of-bounds read in LDT setup
Vulnerability summary
CVE-2022-49395 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.4% of scored vulnerabilities.
Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 1Timeline
- 26-02-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7 __dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x140 syscall_stub_data+0x70/0xe0 write_ldt_entry+0xac/0x190 init_new_ldt+0x515/0x960 init_new_context+0x2c4/0x4d0 mm_init.constprop.0+0x5ed/0x760 mm_alloc+0x118/0x170 0x60033f48 do_one_initcall+0x1d7/0x860 0x60003e7b kernel_init+0x6e/0x3d4 new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1 and is located at offset 64 in frame: init_new_ldt+0x0/0x960 This frame has 2 objects: [32, 40) 'addr' [64, 80) 'desc' ==================================================================
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.0MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu111 products
- linuxAll versions (No fix recorded) | < 4.15.0-192.203 | < 5.4.0-126.142 | < 5.15.0-47.51
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 4.15.0-1140.151 | < 5.4.0-1085.92 | < 5.15.0-1019.23
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Redhat49 products
- bpftool< 0:4.18.0-553.56.1.el8_10
- bpftool-debuginfo< 0:4.18.0-553.56.1.el8_10
- kernel< 0:4.18.0-553.56.1.el8_10
- kernel-abi-stablelists< 0:4.18.0-553.56.1.el8_10
- kernel-core< 0:4.18.0-553.56.1.el8_10
Linux2 products
- linux≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 668ca34a428d6ffc0f99a1a6a9b661a288d4183b | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < ef1dc929a1e5fa1b2d842256db9fb8710d3be910 | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 3549ab4b962cf619e8c55484a0d870a34b3f845f | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 9caad70819aef3431abaf73ba5163b55b161aba0 | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < cf0dabc37446c5ee538ae7b4c467ab0e53fa5463 | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 10995a382271254bd276627ec74136da4a23c4a6 | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 24ca648bf5f72ed8878cf09b5d4431935779681e | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 91e5ba2af2d729d5126aefd5aa3eadc69b8426e5 | ≥ 858259cf7d1c443c836a2022b78cb281f0a9b95e, < 2a4a62a14be1947fa945c5c11ebf67326381a568 | 2.6.15
- linux_kernel≥ 2.6.15, < 4.9.318 | ≥ 4.10, < 4.14.283 | ≥ 4.15, < 4.19.247 | ≥ 4.20, < 5.4.198 | ≥ 5.5, < 5.10.121 | ≥ 5.11, < 5.15.46 | ≥ 5.16, < 5.17.14 | ≥ 5.18, < 5.18.3
Debian1 product
- linux< 5.18.5-1
4 vendors · 163 products
