CVE-2022-48747

block: Fix wrong offset in bio_truncate()

State: Published
Severity: 7.5 High
Published: Jun 20, 2024
Updated: May 23, 2026
Reserved: Jun 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

block: Fix wrong offset in bio_truncate()

bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized data.

This happened when both of truncated/corrupted FS and userspace (via bdev) are trying to read the last of bdev.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-908 Use of Uninitialized Resource

Affected Products

Product	Versions
LinuxLinux	943cd69efac437d82a7aea0659fccbcc071730de to before 6cbf4c731d7812518cd857c2cfc3da9fd120f6aeAffected 85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before b63e120189fd92aff00096d11e2fc5253f60248bAffected 85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before 4633a79ff8bc82770486a063a08b55e5162521d8Affected 85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before 941d5180c430ce5b0f7a3622ef9b76077bfa3d82Affected 85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before 3ee859e384d453d6ac68bfd5971f630d9fa46ad3Affected 5.4.9 to before 5.4.176Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.4.176 through 5.4.Not affected 5.10.96 through 5.10.Not affected 5.15.19 through 5.15.Not affected 5.16.5 through 5.16.Not affected 5.17 and laterNot affected

Product

Versions

LinuxLinux

943cd69efac437d82a7aea0659fccbcc071730de to before 6cbf4c731d7812518cd857c2cfc3da9fd120f6aeAffected
85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before b63e120189fd92aff00096d11e2fc5253f60248bAffected
85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before 4633a79ff8bc82770486a063a08b55e5162521d8Affected
85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before 941d5180c430ce5b0f7a3622ef9b76077bfa3d82Affected
85a8ce62c2eabe28b9d76ca4eecf37922402df93 to before 3ee859e384d453d6ac68bfd5971f630d9fa46ad3Affected
5.4.9 to before 5.4.176Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.4.176 through 5.4.*Not affected
5.10.96 through 5.10.*Not affected
5.15.19 through 5.15.*Not affected
5.16.5 through 5.16.*Not affected
5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.