{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"e917be1f83ea14a68b3cf64d3da9968eaf991dae","status":"affected","version":"b03c9f9fdc37dab81ea04d5dacdc5995d4c224c2","versionType":"git"},{"lessThan":"a7de8d436db92bab8b1f44624297c2554a6ac36b","status":"affected","version":"b03c9f9fdc37dab81ea04d5dacdc5995d4c224c2","versionType":"git"},{"lessThan":"b2a28bb36664c94375926cbbb91976242847699d","status":"affected","version":"b03c9f9fdc37dab81ea04d5dacdc5995d4c224c2","versionType":"git"},{"lessThan":"3844d153a41adea718202c10ae91dc96b37453b5","status":"affected","version":"b03c9f9fdc37dab81ea04d5dacdc5995d4c224c2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.130","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.54","versionType":"semver"},{"lessThanOrEqual":"5.18.*","status":"unaffected","version":"5.18.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"5.19","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2022-49658","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals\n\nKuee reported a corner case where the tnum becomes constant after the call\nto __reg_bound_offset(), but the register's bounds are not, that is, its\nmin bounds are still not equal to the register's max bounds.\n\nThis in turn allows to leak pointers through turning a pointer register as\nis into an unknown scalar via adjust_ptr_min_max_vals().\n\nBefore:\n\n  func#0 @0\n  0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  0: (b7) r0 = 1                        ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))\n  1: (b7) r3 = 0                        ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))\n  2: (87) r3 = -r3                      ; R3_w=scalar()\n  3: (87) r3 = -r3                      ; R3_w=scalar()\n  4: (47) r3 |= 32767                   ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)\n  5: (75) if r3 s>= 0x0 goto pc+1       ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  6: (95) exit\n\n  from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  7: (d5) if r3 s<= 0x8000 goto pc+1    ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  8: (95) exit\n\n  from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  9: (07) r3 += -32767                  ; R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0))  <--- [*]\n  10: (95) exit\n\nWhat can be seen here is that R3=scalar(umin=32767,umax=32768,var_off=(0x7fff;\n0x8000)) after the operation R3 += -32767 results in a 'malformed' constant, that\nis, R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)). Intersecting with var_off has\nnot been done at that point via __update_reg_bounds(), which would have improved\nthe umax to be equal to umin.\n\nRefactor the tnum <> min/max bounds information flow into a reg_bounds_sync()\nhelper and use it consistently everywhere. After the fix, bounds have been\ncorrected to R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) and thus the register\nis regarded as a 'proper' constant scalar of 0.\n\nAfter:\n\n  func#0 @0\n  0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  0: (b7) r0 = 1                        ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))\n  1: (b7) r3 = 0                        ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))\n  2: (87) r3 = -r3                      ; R3_w=scalar()\n  3: (87) r3 = -r3                      ; R3_w=scalar()\n  4: (47) r3 |= 32767                   ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)\n  5: (75) if r3 s>= 0x0 goto pc+1       ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  6: (95) exit\n\n  from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))\n  7: (d5) if r3 s<= 0x8000 goto pc+1    ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)\n  8: (95) exit\n\n  from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0\n---truncated---","epss":{"date":"2026-11-05","percentile":0.20671,"score":0.00281},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793908181689,"publishedAt":1740536636922,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e917be1f83ea14a68b3cf64d3da9968eaf991dae"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/a7de8d436db92bab8b1f44624297c2554a6ac36b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b2a28bb36664c94375926cbbb91976242847699d"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3844d153a41adea718202c10ae91dc96b37453b5"}],"remediation":[],"revision":"3ac93c883f8d3400f7bcc057c8f9a3e4b9b1decfd4275a6d645c2d7f9ab1ea31","sources":[{"modifiedAt":1793908181689,"name":"CNA: Linux","retrievedAt":1793909383495,"url":"https://www.cve.org/CVERecord?id=CVE-2022-49658"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793909408671,"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-49658"}],"ssvc":{"assessedAt":1793907999344,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals","updatedAt":1793909408671}