CVE-2022-49710: dm mirror log: round up region bitmap size to BITS_PER_LONG

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITS_PER_LONG The code in dm-log rounds up bitset_size to 32 bits. It then uses find_next_zero_bit_le on the allocated region. find_next_zero_bit_le accesses the bitmap using unsigned long pointers. So, on 64-bit architectures, it may access 4 bytes beyond the allocated size. Fix this bug by rounding up bitset_size to BITS_PER_LONG. This bug was found by running the lvm2 testsuite with kasan.

Affected products

Linux kernel: from 2.6.18 before 5.4.200; from 5.5 before 5.10.124; from 5.11 before 5.15.49; from 5.16 before 5.18.6; 5.19-rc1, 5.19-rc2 — fixed in 5.10.124, 5.15.49, 5.18.6, 5.4.200

How to fix

Upgrade to a fixed version: Linux kernel 5.10.124, 5.15.49, 5.18.6, 5.4.200. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49710 or the next vulnerability affects your stack