# CVE-2022-49993: loop: Check for overflow while configuring loop

Status: published. Published: 2025-06-18. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

loop: Check for overflow while configuring loop

The userspace can configure a loop using an ioctl call, wherein
a configuration of type loop_config is passed (see lo_ioctl()'s
case on line 1550 of drivers/block/loop.c). This proceeds to call
loop_configure() which in turn calls loop_set_status_from_info()
(see line 1050 of loop.c), passing &config->info which is of type
loop_info64*. This function then sets the appropriate values, like
the offset.

loop_device has lo_offset of type loff_t (see line 52 of loop.c),
which is typdef-chained to long long, whereas loop_info64 has
lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).

The function directly copies offset from info to the device as
follows (See line 980 of loop.c):
	lo->lo_offset = info->lo_offset;

This results in an overflow, which triggers a warning in iomap_iter()
due to a call to iomap_iter_done() which has:
	WARN_ON_ONCE(iter->iomap.offset > iter->pos);

Thus, check for negative value during loop_set_status_from_info().

Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 18e28817cb516b39de6281f6db9b0618b2cc7b42 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < adf0112d9b8acb03485624220b4934f69bf13369 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < a217715338fd48f72114725aa7a40e484a781ca7 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < b40877b8562c5720d0a7fce20729f56b75a3dede (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 6858933131d0dadac071c4d33335a9ea4b8e76cf (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 0455bef69028c65065f16bb04635591b2374249b (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < 9be7fa7ead18a48940df7b59d993bbc8b9055c15 (affected, git); ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2; < c490a0b5a4f36da3918181a8acdc6991d967c5f3 (affected, git). Source: CNA: Linux
- Linux / Linux: 2.6.12 (affected); ≥ 0; < 2.6.12 (unaffected, semver); ≥ 4.9.327; ≤ 4.9.* (unaffected, semver); ≥ 4.14.292; ≤ 4.14.* (unaffected, semver); ≥ 4.19.312; ≤ 4.19.* (unaffected, semver); ≥ 5.4.274; ≤ 5.4.* (unaffected, semver); ≥ 5.10.140; ≤ 5.10.* (unaffected, semver); ≥ 5.15.64; ≤ 5.15.* (unaffected, semver); ≥ 5.19.6; ≤ 5.19.* (unaffected, semver); ≥ 6.0; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.25% as of 2026-11-05; percentile 16.95%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42 (CNA: Linux)

- https://git.kernel.org/stable/c/adf0112d9b8acb03485624220b4934f69bf13369 (CNA: Linux)

- https://git.kernel.org/stable/c/a217715338fd48f72114725aa7a40e484a781ca7 (CNA: Linux)

- https://git.kernel.org/stable/c/b40877b8562c5720d0a7fce20729f56b75a3dede (CNA: Linux)

- https://git.kernel.org/stable/c/6858933131d0dadac071c4d33335a9ea4b8e76cf (CNA: Linux)

- https://git.kernel.org/stable/c/0455bef69028c65065f16bb04635591b2374249b (CNA: Linux)

- https://git.kernel.org/stable/c/9be7fa7ead18a48940df7b59d993bbc8b9055c15 (CNA: Linux)

- https://git.kernel.org/stable/c/c490a0b5a4f36da3918181a8acdc6991d967c5f3 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-49993; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-49993; retrieved 2026-11-05; source updated Not reported

Revision: a8177f2df7092263589b340bfd544b1cf86b5dae882b6b4566fdd4135e5d9b9d

Canonical: https://y2.dev/cve/CVE-2022-49993

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.