{"id":"CVE-2022-49993","title":"loop: Check for overflow while configuring loop","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Check for overflow while configuring loop\n\nThe userspace can configure a loop using an ioctl call, wherein\na configuration of type loop_config is passed (see lo_i…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 18e28817cb516b39de6281f6db9b0618b2cc7b42","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < adf0112d9b8acb03485624220b4934f69bf13369","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a217715338fd48f72114725aa7a40e484a781ca7","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b40877b8562c5720d0a7fce20729f56b75a3dede","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6858933131d0dadac071c4d33335a9ea4b8e76cf","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0455bef69028c65065f16bb04635591b2374249b","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9be7fa7ead18a48940df7b59d993bbc8b9055c15","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c490a0b5a4f36da3918181a8acdc6991d967c5f3","Linux 2.6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:52:33.900934Z"},"published":"2025-06-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:00:13.340Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49993","references":[{"url":"https://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42"},{"url":"https://git.kernel.org/stable/c/adf0112d9b8acb03485624220b4934f69bf13369"},{"url":"https://git.kernel.org/stable/c/a217715338fd48f72114725aa7a40e484a781ca7"},{"url":"https://git.kernel.org/stable/c/b40877b8562c5720d0a7fce20729f56b75a3dede"},{"url":"https://git.kernel.org/stable/c/6858933131d0dadac071c4d33335a9ea4b8e76cf"},{"url":"https://git.kernel.org/stable/c/0455bef69028c65065f16bb04635591b2374249b"},{"url":"https://git.kernel.org/stable/c/9be7fa7ead18a48940df7b59d993bbc8b9055c15"},{"url":"https://git.kernel.org/stable/c/c490a0b5a4f36da3918181a8acdc6991d967c5f3"}],"tags":["cve.org"],"epss":0.00253,"epssPercentile":0.16941,"ingestedAt":"2026-11-05T22:38:31.633Z","slug":"CVE-2022-49993","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nloop: Check for overflow while configuring loop\n\nThe userspace can configure a loop using an ioctl call, wherein\na configuration of type loop_config is passed (see lo_ioctl()'s\ncase on line 1550 of drivers/block/loop.c). This proceeds to call\nloop_configure() which in turn calls loop_set_status_from_info()\n(see line 1050 of loop.c), passing &config->info which is of type\nloop_info64*. This function then sets the appropriate values, like\nthe offset.\n\nloop_device has lo_offset of type loff_t (see line 52 of loop.c),\nwhich is typdef-chained to long long, whereas loop_info64 has\nlo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).\n\nThe function directly copies offset from info to the device as\nfollows (See line 980 of loop.c):\n\tlo->lo_offset = info->lo_offset;\n\nThis results in an overflow, which triggers a warning in iomap_iter()\ndue to a call to iomap_iter_done() which has:\n\tWARN_ON_ONCE(iter->iomap.offset > iter->pos);\n\nThus, check for negative value during loop_set_status_from_info().\n\nBug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 18e28817cb516b39de6281f6db9b0618b2cc7b42`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < adf0112d9b8acb03485624220b4934f69bf13369`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a217715338fd48f72114725aa7a40e484a781ca7`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b40877b8562c5720d0a7fce20729f56b75a3dede`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6858933131d0dadac071c4d33335a9ea4b8e76cf`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0455bef69028c65065f16bb04635591b2374249b`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9be7fa7ead18a48940df7b59d993bbc8b9055c15`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c490a0b5a4f36da3918181a8acdc6991d967c5f3`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}