CVE-2022-49770ceph: avoid putting the realm twice when decoding snaps fails
- 9.8CriticalCVSS base score
- 0.58%Exploitation in 30 daysEPSS · top 52% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON, etc issues.
Timeline
ID reserved
By Linux
- 15 days later
· 15 days later
Published
- 16 months later
· 16 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.58% · top 52% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 982d6011bc30a26e8a3d546e0e7fc7db2c255d85 – < 274e4c79a3a2a24fba7cfe0e41113f1138785c37
- affected 982d6011bc30a26e8a3d546e0e7fc7db2c255d85 – < cb7495fe957526555782ce0723f79ce92a6db22e
- affected 982d6011bc30a26e8a3d546e0e7fc7db2c255d85 – < 044bc6d3c2c0e9090b0841e7b723875756534b45
- affected 982d6011bc30a26e8a3d546e0e7fc7db2c255d85 – < 2f6e2de3a5289004650118b61f138fe7c28e1905
- affected 982d6011bc30a26e8a3d546e0e7fc7db2c255d85 – < fd879c83e87735ab8f00ef7755752cf0cbae24b2
- affected 982d6011bc30a26e8a3d546e0e7fc7db2c255d85 – < 51884d153f7ec85e18d607b2467820a90e0f4359
- affected 4.0
- unaffected < 4.0
- unaffected 4.19.268 – ≤ 4.19.*
- unaffected 5.4.226 – ≤ 5.4.*
- unaffected 5.10.157 – ≤ 5.10.*
- unaffected 5.15.81 – ≤ 5.15.*
- unaffected 6.0.10 – ≤ 6.0.*
- unaffected 6.1 – ≤ *
References
References6
- https://git.kernel.org/stable/c/274e4c79a3a2a24fba7cfe0e41113f1138785c37 (opens in a new tab)
- https://git.kernel.org/stable/c/cb7495fe957526555782ce0723f79ce92a6db22e (opens in a new tab)
- https://git.kernel.org/stable/c/044bc6d3c2c0e9090b0841e7b723875756534b45 (opens in a new tab)
- https://git.kernel.org/stable/c/2f6e2de3a5289004650118b61f138fe7c28e1905 (opens in a new tab)
- https://git.kernel.org/stable/c/fd879c83e87735ab8f00ef7755752cf0cbae24b2 (opens in a new tab)
- https://git.kernel.org/stable/c/51884d153f7ec85e18d607b2467820a90e0f4359 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-12989 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-49770)Record last updated .