CVE-2022-49058

cifs: potential buffer overflow in handling symlinks

State: Published
Severity: 9.1 Critical
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: potential buffer overflow in handling symlinks

Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max)

It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected Products

Product	Versions
LinuxLinux	c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 3e582749e742e662a8e9bb37cffac62dccaaa1e2Affected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 1316c28569a80ab3596eeab05bf5e01991e7e739Affected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before eb5f51756944735ac70cd8bb38637cc202e29c91Affected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 22d658c6c5affed10c8907e67160cef0b6c92186Affected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 4e166a41180be2f1e66bbb6d46448e80a9a5ec05Affected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 9901b07ba42b39266b34a888e48d7306fd707beeAffected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 515e7ba11ef043d6febe69389949c8ef5f25e9d0Affected c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 64c4a37ac04eeb43c42d272f6e6c8c12bfcf4304Affected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 4.9.311 through 4.9.Not affected 4.14.276 through 4.14.Not affected 4.19.239 through 4.19.Not affected 5.4.190 through 5.4.Not affected 5.10.112 through 5.10.Not affected 5.15.35 through 5.15.Not affected 5.17.4 through 5.17.*Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 3e582749e742e662a8e9bb37cffac62dccaaa1e2Affected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 1316c28569a80ab3596eeab05bf5e01991e7e739Affected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before eb5f51756944735ac70cd8bb38637cc202e29c91Affected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 22d658c6c5affed10c8907e67160cef0b6c92186Affected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 4e166a41180be2f1e66bbb6d46448e80a9a5ec05Affected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 9901b07ba42b39266b34a888e48d7306fd707beeAffected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 515e7ba11ef043d6febe69389949c8ef5f25e9d0Affected
c69c1b6eaea1b3e1eecf7ad2fba0208ac4a11131 to before 64c4a37ac04eeb43c42d272f6e6c8c12bfcf4304Affected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
4.9.311 through 4.9.*Not affected
4.14.276 through 4.14.*Not affected
4.19.239 through 4.19.*Not affected
5.4.190 through 5.4.*Not affected
5.10.112 through 5.10.*Not affected
5.15.35 through 5.15.*Not affected
5.17.4 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.