# CVE-2022-49771: dm ioctl: fix misbehavior if list_versions races with module loading

Status: published. Published: 2025-05-01. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

dm ioctl: fix misbehavior if list_versions races with module loading

__list_versions will first estimate the required space using the
"dm_target_iterate(list_version_get_needed, &needed)" call and then will
fill the space using the "dm_target_iterate(list_version_get_info,
&iter_info)" call. Each of these calls locks the targets using the
"down_read(&_lock)" and "up_read(&_lock)" calls, however between the first
and second "dm_target_iterate" there is no lock held and the target
modules can be loaded at this point, so the second "dm_target_iterate"
call may need more space than what was the first "dm_target_iterate"
returned.

The code tries to handle this overflow (see the beginning of
list_version_get_info), however this handling is incorrect.

The code sets "param->data_size = param->data_start + needed" and
"iter_info.end = (char *)vers+len" - "needed" is the size returned by the
first dm_target_iterate call; "len" is the size of the buffer allocated by
userspace.

"len" may be greater than "needed"; in this case, the code will write up
to "len" bytes into the buffer, however param->data_size is set to
"needed", so it may write data past the param->data_size value. The ioctl
interface copies only up to param->data_size into userspace, thus part of
the result will be truncated.

Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this
guarantees that the second "dm_target_iterate" call will write only up to
the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it
overflows the "needed" space - in this case, userspace will allocate a
larger buffer and retry.

Note that there is also a bug in list_version_get_needed - we need to add
"strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 0c8d4112df329bf3dfbf27693f918c3b08676538 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 6a818db0d5aecf80d4ba9e10ac153f60adc629ca (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 3a1c35d72dc0b34d1e746ed705790c0f630aa427 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < b545c0e1e4094d4de2bdfe9a3823f9154b0c0005 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < f59f5a269ca5e43c567aca7f1f52500a0186e9b7 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 5398b8e275bf81a2517b327d216c0f37ac9ac5ae (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 4fe1ec995483737f3d2a14c3fe1d8fe634972979 (affected, git). Source: CNA: Linux
- Linux / Linux: 2.6.12 (affected); ≥ 0; < 2.6.12 (unaffected, semver); ≥ 4.9.334; ≤ 4.9.* (unaffected, semver); ≥ 4.14.300; ≤ 4.14.* (unaffected, semver); ≥ 4.19.267; ≤ 4.19.* (unaffected, semver); ≥ 5.4.225; ≤ 5.4.* (unaffected, semver); ≥ 5.10.156; ≤ 5.10.* (unaffected, semver); ≥ 5.15.80; ≤ 5.15.* (unaffected, semver); ≥ 6.0.10; ≤ 6.0.* (unaffected, semver); ≥ 6.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.16% as of 2026-11-05; percentile 5.07%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/0c8d4112df329bf3dfbf27693f918c3b08676538 (CNA: Linux)

- https://git.kernel.org/stable/c/6a818db0d5aecf80d4ba9e10ac153f60adc629ca (CNA: Linux)

- https://git.kernel.org/stable/c/3a1c35d72dc0b34d1e746ed705790c0f630aa427 (CNA: Linux)

- https://git.kernel.org/stable/c/b545c0e1e4094d4de2bdfe9a3823f9154b0c0005 (CNA: Linux)

- https://git.kernel.org/stable/c/f59f5a269ca5e43c567aca7f1f52500a0186e9b7 (CNA: Linux)

- https://git.kernel.org/stable/c/6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b (CNA: Linux)

- https://git.kernel.org/stable/c/5398b8e275bf81a2517b327d216c0f37ac9ac5ae (CNA: Linux)

- https://git.kernel.org/stable/c/4fe1ec995483737f3d2a14c3fe1d8fe634972979 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-49771; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-49771; retrieved 2026-11-05; source updated Not reported

Revision: 09bb0261d56ef0de67f93cd00c27782baf7c0c242eea22563fce81a38bdc1ecb

Canonical: https://y2.dev/cve/CVE-2022-49771

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.