CVE-2022-49166 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: add sanity check on allocation size ntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation size. It triggers one BUG in the __ntfs_malloc function. Fix this by adding sanity check on ni->attr_list_size.
A vulnerability in the Linux kernel's NTFS file system handling has been addressed. The issue arose because the 'ntfs_read_inode_mount' function called 'ntfs_malloc_nofs' with a zero allocation size, which triggered a bug in the memory management function '__ntfs_malloc'. This vulnerability has been fixed by adding a sanity check on the attribute list size to prevent zero allocations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/07793d2e55563124108762f4e5f811db92ffe02f | kernel.org | Patch |
| https://git.kernel.org/stable/c/115fae2c1566eacc5ad2055f72521354612e72c3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/21d490232f323ed4053eb9924615e6fea291f154 | kernel.org | Patch |
| https://git.kernel.org/stable/c/24ab2d4ef52c2dbb62a60844b87fc8872383407a | kernel.org | Patch |
| https://git.kernel.org/stable/c/714fbf2647b1a33d914edd695d4da92029c7e7c0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b230f2d9441a34c7f483d39ab78519bcf73cc2e0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bd8d7daa0e53b184a2f3c6e0d47330780d0a0650 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c641087d381a08363e5f14179bc6b0a23eca7c47 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fe41ad8be036a3de3e4bdde709551aeb4de2fe7d | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | < 4.9.311 >= 4.10, < 4.14.276 >= 4.15, < 4.19.238 >= 4.20, < 5.4.189 >= 5.5, < 5.10.110 >= 5.11, < 5.15.33 >= 5.16, < 5.16.19 >= 5.17, < 5.17.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Oct 15, 2025 | Initial Analysis | [email protected] |
| Feb 26, 2025 | New CVE Received | kernel.org |