Riskcovery

CVE-2022-49743

ovl: Use "buf" flexible array for memcpy() destination

State
Published
Severity
7.5 High
Published
Mar 27, 2025
Updated
Oct 15, 2026
Reserved
Mar 27, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ovl: Use "buf" flexible array for memcpy() destination

The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening:

memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:799 (size 21)

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 to before 012cdef22000f3104e4fa8224ad29fde509b8cafAffected
  • cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 to before a77141a06367825d639ac51b04703d551163e36cAffected
  • cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 to before 07a96977b2f462337a9121302de64277b8747ab1Affected
  • cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 to before cf8aa9bf97cadf85745506c6a3e244b22c268d63Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 5.10.248 through 5.10.*Not affected
  • 5.15.93 through 5.15.*Not affected
  • 6.1.11 through 6.1.*Not affected
  • 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.