{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"b2cc07a76f1eb12de3b22caf5fdbf856a7bef16d","status":"affected","version":"3d3c95046742e4eebaa4b891b0b01cbbed94ebbd","versionType":"git"},{"lessThan":"7e043a80b5dae5c2d2cf84031501de7827fd6c00","status":"affected","version":"3d3c95046742e4eebaa4b891b0b01cbbed94ebbd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2022-49810","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing xas_retry() calls in xarray iteration\n\nnetfslib has a number of places in which it performs iteration of an xarray\nwhilst being under the RCU read lock.  It *should* call xas_retry() as the\nfirst thing inside of the loop and do \"continue\" if it returns true in case\nthe xarray walker passed out a special value indicating that the walk needs\nto be redone from the root[*].\n\nFix this by adding the missing retry checks.\n\n[*] I wonder if this should be done inside xas_find(), xas_next_node() and\n    suchlike, but I'm told that's not an simple change to effect.\n\nThis can cause an oops like that below.  Note the faulting address - this\nis an internal value (|0x2) returned from xarray.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000402\n...\nRIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs]\n...\nCall Trace:\n netfs_rreq_assess+0xa6/0x240 [netfs]\n netfs_readpage+0x173/0x3b0 [netfs]\n ? init_wait_var_entry+0x50/0x50\n filemap_read_page+0x33/0xf0\n filemap_get_pages+0x2f2/0x3f0\n filemap_read+0xaa/0x320\n ? do_filp_open+0xb2/0x150\n ? rmqueue+0x3be/0xe10\n ceph_read_iter+0x1fe/0x680 [ceph]\n ? new_sync_read+0x115/0x1a0\n new_sync_read+0x115/0x1a0\n vfs_read+0xf3/0x180\n ksys_read+0x5f/0xe0\n do_syscall_64+0x38/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nChanges:\n========\nver #2)\n - Changed an unsigned int to a size_t to reduce the likelihood of an\n   overflow as per Willy's suggestion.\n - Added an additional patch to fix the maths.","epss":{"date":"2026-11-05","percentile":0.06474,"score":0.0017},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793908190528,"publishedAt":1746108575470,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b2cc07a76f1eb12de3b22caf5fdbf856a7bef16d"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/7e043a80b5dae5c2d2cf84031501de7827fd6c00"}],"remediation":[],"revision":"055e9e0d8d8d4131224d5eb7ee4f08ce861f21324d96cf64af533bdf9dfa6ca8","sources":[{"modifiedAt":1793908190528,"name":"CNA: Linux","retrievedAt":1793909443246,"url":"https://www.cve.org/CVERecord?id=CVE-2022-49810"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793909452886,"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-49810"}],"ssvc":{"assessedAt":1793908148202,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"netfs: Fix missing xas_retry() calls in xarray iteration","updatedAt":1793909452886}