---
id: CVE-2022-49993
title: 'loop: Check for overflow while configuring loop'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  loop: Check for overflow while configuring loop

  The userspace can configure a loop using an ioctl call, wherein
  a configuration of type loop_config is passed (see lo_i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    18e28817cb516b39de6281f6db9b0618b2cc7b42
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    adf0112d9b8acb03485624220b4934f69bf13369
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a217715338fd48f72114725aa7a40e484a781ca7
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b40877b8562c5720d0a7fce20729f56b75a3dede
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6858933131d0dadac071c4d33335a9ea4b8e76cf
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    0455bef69028c65065f16bb04635591b2374249b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    9be7fa7ead18a48940df7b59d993bbc8b9055c15
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    c490a0b5a4f36da3918181a8acdc6991d967c5f3
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:52:33.900934Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:13.340Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49993'
references:
  - url: 'https://git.kernel.org/stable/c/18e28817cb516b39de6281f6db9b0618b2cc7b42'
  - url: 'https://git.kernel.org/stable/c/adf0112d9b8acb03485624220b4934f69bf13369'
  - url: 'https://git.kernel.org/stable/c/a217715338fd48f72114725aa7a40e484a781ca7'
  - url: 'https://git.kernel.org/stable/c/b40877b8562c5720d0a7fce20729f56b75a3dede'
  - url: 'https://git.kernel.org/stable/c/6858933131d0dadac071c4d33335a9ea4b8e76cf'
  - url: 'https://git.kernel.org/stable/c/0455bef69028c65065f16bb04635591b2374249b'
  - url: 'https://git.kernel.org/stable/c/9be7fa7ead18a48940df7b59d993bbc8b9055c15'
  - url: 'https://git.kernel.org/stable/c/c490a0b5a4f36da3918181a8acdc6991d967c5f3'
tags:
  - cve.org
epss: 0.00253
epssPercentile: 0.16941
ingestedAt: '2026-11-05T22:38:31.633Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

loop: Check for overflow while configuring loop

The userspace can configure a loop using an ioctl call, wherein
a configuration of type loop_config is passed (see lo_ioctl()'s
case on line 1550 of drivers/block/loop.c). This proceeds to call
loop_configure() which in turn calls loop_set_status_from_info()
(see line 1050 of loop.c), passing &config->info which is of type
loop_info64*. This function then sets the appropriate values, like
the offset.

loop_device has lo_offset of type loff_t (see line 52 of loop.c),
which is typdef-chained to long long, whereas loop_info64 has
lo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).

The function directly copies offset from info to the device as
follows (See line 980 of loop.c):
	lo->lo_offset = info->lo_offset;

This results in an overflow, which triggers a warning in iomap_iter()
due to a call to iomap_iter_done() which has:
	WARN_ON_ONCE(iter->iomap.offset > iter->pos);

Thus, check for negative value during loop_set_status_from_info().

Bug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 18e28817cb516b39de6281f6db9b0618b2cc7b42`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < adf0112d9b8acb03485624220b4934f69bf13369`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a217715338fd48f72114725aa7a40e484a781ca7`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b40877b8562c5720d0a7fce20729f56b75a3dede`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6858933131d0dadac071c4d33335a9ea4b8e76cf`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0455bef69028c65065f16bb04635591b2374249b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9be7fa7ead18a48940df7b59d993bbc8b9055c15`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c490a0b5a4f36da3918181a8acdc6991d967c5f3`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.