---
id: CVE-2022-49771
title: 'dm ioctl: fix misbehavior if list_versions races with module loading'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dm ioctl: fix misbehavior if list_versions races with module loading

  __list_versions will first estimate the required space using the
  "dm_target_iterate(list_version_g…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    0c8d4112df329bf3dfbf27693f918c3b08676538
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6a818db0d5aecf80d4ba9e10ac153f60adc629ca
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3a1c35d72dc0b34d1e746ed705790c0f630aa427
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b545c0e1e4094d4de2bdfe9a3823f9154b0c0005
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f59f5a269ca5e43c567aca7f1f52500a0186e9b7
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5398b8e275bf81a2517b327d216c0f37ac9ac5ae
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    4fe1ec995483737f3d2a14c3fe1d8fe634972979
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:47:10.840760Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:42.811Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49771'
references:
  - url: 'https://git.kernel.org/stable/c/0c8d4112df329bf3dfbf27693f918c3b08676538'
  - url: 'https://git.kernel.org/stable/c/6a818db0d5aecf80d4ba9e10ac153f60adc629ca'
  - url: 'https://git.kernel.org/stable/c/3a1c35d72dc0b34d1e746ed705790c0f630aa427'
  - url: 'https://git.kernel.org/stable/c/b545c0e1e4094d4de2bdfe9a3823f9154b0c0005'
  - url: 'https://git.kernel.org/stable/c/f59f5a269ca5e43c567aca7f1f52500a0186e9b7'
  - url: 'https://git.kernel.org/stable/c/6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b'
  - url: 'https://git.kernel.org/stable/c/5398b8e275bf81a2517b327d216c0f37ac9ac5ae'
  - url: 'https://git.kernel.org/stable/c/4fe1ec995483737f3d2a14c3fe1d8fe634972979'
tags:
  - cve.org
epss: 0.00159
epssPercentile: 0.0507
ingestedAt: '2026-11-05T22:38:31.586Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dm ioctl: fix misbehavior if list_versions races with module loading

__list_versions will first estimate the required space using the
"dm_target_iterate(list_version_get_needed, &needed)" call and then will
fill the space using the "dm_target_iterate(list_version_get_info,
&iter_info)" call. Each of these calls locks the targets using the
"down_read(&_lock)" and "up_read(&_lock)" calls, however between the first
and second "dm_target_iterate" there is no lock held and the target
modules can be loaded at this point, so the second "dm_target_iterate"
call may need more space than what was the first "dm_target_iterate"
returned.

The code tries to handle this overflow (see the beginning of
list_version_get_info), however this handling is incorrect.

The code sets "param->data_size = param->data_start + needed" and
"iter_info.end = (char *)vers+len" - "needed" is the size returned by the
first dm_target_iterate call; "len" is the size of the buffer allocated by
userspace.

"len" may be greater than "needed"; in this case, the code will write up
to "len" bytes into the buffer, however param->data_size is set to
"needed", so it may write data past the param->data_size value. The ioctl
interface copies only up to param->data_size into userspace, thus part of
the result will be truncated.

Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this
guarantees that the second "dm_target_iterate" call will write only up to
the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it
overflows the "needed" space - in this case, userspace will allocate a
larger buffer and retry.

Note that there is also a bug in list_version_get_needed - we need to add
"strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0c8d4112df329bf3dfbf27693f918c3b08676538`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6a818db0d5aecf80d4ba9e10ac153f60adc629ca`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3a1c35d72dc0b34d1e746ed705790c0f630aa427`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b545c0e1e4094d4de2bdfe9a3823f9154b0c0005`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f59f5a269ca5e43c567aca7f1f52500a0186e9b7`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5398b8e275bf81a2517b327d216c0f37ac9ac5ae`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4fe1ec995483737f3d2a14c3fe1d8fe634972979`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.