GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49296 (GCVE-0-2022-49296)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:01 – Updated: 2026-08-12 23:58
VLAI
Title
ceph: fix possible deadlock when holding Fwb to get inline_data
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when holding Fwb to get inline_data 1, mount with wsync. 2, create a file with O_RDWR, and the request was sent to mds.0: ceph_atomic_open()--> ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--> ceph_open()--> ceph_init_file()--> ceph_init_file_info()--> ceph_uninline_data()--> { ... if (inline_version == 1 || /* initial version, no data */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } The inline_version will be 1, which is the initial version for the new create file. And here the ci->i_inline_version will keep with 1, it's buggy. 3, buffer write to the file immediately: ceph_write_iter()--> ceph_get_caps(file, need=Fw, want=Fb, ...); generic_perform_write()--> a_ops->write_begin()--> ceph_write_begin()--> netfs_write_begin()--> netfs_begin_read()--> netfs_rreq_submit_slice()--> netfs_read_from_server()--> rreq->netfs_ops->issue_read()--> ceph_netfs_issue_read()--> { ... if (ci->i_inline_version != CEPH_INLINE_NONE && ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to mds.1. 4, then the mds.1 will request the rd lock for CInode::filelock from the auth mds.0, the mds.0 will do the CInode::filelock state transation from excl --> sync, but it need to revoke the Fxwb caps back from the clients. While the kernel client has aleady held the Fwb caps and waiting for the getattr(Fsr). It's deadlock! URL: https://tracker.ceph.com/issues/55377
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:44 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 083db6fd3e73fc4f9ee74d2da1012a94216d6a60 , < 292b7a7275ce535a1abfa4dd0b2e586162aaae1e (git)
Affected: 083db6fd3e73fc4f9ee74d2da1012a94216d6a60 , < 825978fd6a0defc3c29d8a38b6cea76a0938d21e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.18.4 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49296",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:44:59.503744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:59.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "292b7a7275ce535a1abfa4dd0b2e586162aaae1e",
              "status": "affected",
              "version": "083db6fd3e73fc4f9ee74d2da1012a94216d6a60",
              "versionType": "git"
            },
            {
              "lessThan": "825978fd6a0defc3c29d8a38b6cea76a0938d21e",
              "status": "affected",
              "version": "083db6fd3e73fc4f9ee74d2da1012a94216d6a60",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix possible deadlock when holding Fwb to get inline_data\n\n1, mount with wsync.\n2, create a file with O_RDWR, and the request was sent to mds.0:\n\n   ceph_atomic_open()--\u003e\n     ceph_mdsc_do_request(openc)\n     finish_open(file, dentry, ceph_open)--\u003e\n       ceph_open()--\u003e\n         ceph_init_file()--\u003e\n           ceph_init_file_info()--\u003e\n             ceph_uninline_data()--\u003e\n             {\n               ...\n               if (inline_version == 1 || /* initial version, no data */\n                   inline_version == CEPH_INLINE_NONE)\n                     goto out_unlock;\n               ...\n             }\n\nThe inline_version will be 1, which is the initial version for the\nnew create file. And here the ci-\u003ei_inline_version will keep with 1,\nit\u0027s buggy.\n\n3, buffer write to the file immediately:\n\n   ceph_write_iter()--\u003e\n     ceph_get_caps(file, need=Fw, want=Fb, ...);\n     generic_perform_write()--\u003e\n       a_ops-\u003ewrite_begin()--\u003e\n         ceph_write_begin()--\u003e\n           netfs_write_begin()--\u003e\n             netfs_begin_read()--\u003e\n               netfs_rreq_submit_slice()--\u003e\n                 netfs_read_from_server()--\u003e\n                   rreq-\u003enetfs_ops-\u003eissue_read()--\u003e\n                     ceph_netfs_issue_read()--\u003e\n                     {\n                       ...\n                       if (ci-\u003ei_inline_version != CEPH_INLINE_NONE \u0026\u0026\n                           ceph_netfs_issue_op_inline(subreq))\n                         return;\n                       ...\n                     }\n     ceph_put_cap_refs(ci, Fwb);\n\nThe ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to\nmds.1.\n\n4, then the mds.1 will request the rd lock for CInode::filelock from\nthe auth mds.0, the mds.0 will do the CInode::filelock state transation\nfrom excl --\u003e sync, but it need to revoke the Fxwb caps back from the\nclients.\n\nWhile the kernel client has aleady held the Fwb caps and waiting for\nthe getattr(Fsr).\n\nIt\u0027s deadlock!\n\nURL: https://tracker.ceph.com/issues/55377"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T23:58:22.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/292b7a7275ce535a1abfa4dd0b2e586162aaae1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/825978fd6a0defc3c29d8a38b6cea76a0938d21e"
        }
      ],
      "title": "ceph: fix possible deadlock when holding Fwb to get inline_data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49296",
    "datePublished": "2025-02-26T02:01:26.131Z",
    "dateReserved": "2025-02-26T01:49:39.302Z",
    "dateUpdated": "2026-08-12T23:58:22.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49296",
      "date": "2026-09-16",
      "epss": "0.00168",
      "percentile": "0.06431"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49296\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:06.433\",\"lastModified\":\"2026-08-13T00:17:31.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix possible deadlock when holding Fwb to get inline_data\\n\\n1, mount with wsync.\\n2, create a file with O_RDWR, and the request was sent to mds.0:\\n\\n   ceph_atomic_open()--\u003e\\n     ceph_mdsc_do_request(openc)\\n     finish_open(file, dentry, ceph_open)--\u003e\\n       ceph_open()--\u003e\\n         ceph_init_file()--\u003e\\n           ceph_init_file_info()--\u003e\\n             ceph_uninline_data()--\u003e\\n             {\\n               ...\\n               if (inline_version == 1 || /* initial version, no data */\\n                   inline_version == CEPH_INLINE_NONE)\\n                     goto out_unlock;\\n               ...\\n             }\\n\\nThe inline_version will be 1, which is the initial version for the\\nnew create file. And here the ci-\u003ei_inline_version will keep with 1,\\nit\u0027s buggy.\\n\\n3, buffer write to the file immediately:\\n\\n   ceph_write_iter()--\u003e\\n     ceph_get_caps(file, need=Fw, want=Fb, ...);\\n     generic_perform_write()--\u003e\\n       a_ops-\u003ewrite_begin()--\u003e\\n         ceph_write_begin()--\u003e\\n           netfs_write_begin()--\u003e\\n             netfs_begin_read()--\u003e\\n               netfs_rreq_submit_slice()--\u003e\\n                 netfs_read_from_server()--\u003e\\n                   rreq-\u003enetfs_ops-\u003eissue_read()--\u003e\\n                     ceph_netfs_issue_read()--\u003e\\n                     {\\n                       ...\\n                       if (ci-\u003ei_inline_version != CEPH_INLINE_NONE \u0026\u0026\\n                           ceph_netfs_issue_op_inline(subreq))\\n                         return;\\n                       ...\\n                     }\\n     ceph_put_cap_refs(ci, Fwb);\\n\\nThe ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to\\nmds.1.\\n\\n4, then the mds.1 will request the rd lock for CInode::filelock from\\nthe auth mds.0, the mds.0 will do the CInode::filelock state transation\\nfrom excl --\u003e sync, but it need to revoke the Fxwb caps back from the\\nclients.\\n\\nWhile the kernel client has aleady held the Fwb caps and waiting for\\nthe getattr(Fsr).\\n\\nIt\u0027s deadlock!\\n\\nURL: https://tracker.ceph.com/issues/55377\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ceph: se corrige un posible bloqueo al mantener presionado Fwb para obtener inline_data 1, montar con wsync. 2, crear un archivo con O_RDWR y la solicitud se envi\u00f3 a mds.0: ceph_atomic_open()--\u0026gt; ceph_mdsc_do_request(openc) finish_open(file, dentry, ceph_open)--\u0026gt; ceph_open()--\u0026gt; ceph_init_file()--\u0026gt; ceph_init_file_info()--\u0026gt; ceph_uninline_data()--\u0026gt; { ... if (inline_version == 1 || /* versi\u00f3n inicial, sin datos */ inline_version == CEPH_INLINE_NONE) goto out_unlock; ... } La inline_version ser\u00e1 1, que es la versi\u00f3n inicial para el nuevo archivo de creaci\u00f3n. Y aqu\u00ed, ci-\u0026gt;i_inline_version se mantendr\u00e1 con 1, es un error. 3, escribe en el b\u00fafer inmediatamente en el archivo: ceph_write_iter()--\u0026gt; ceph_get_caps(archivo, necesidad=Fw, deseo=Fb, ...); generic_perform_write()--\u0026gt; a_ops-\u0026gt;write_begin()--\u0026gt; ceph_write_begin()--\u0026gt; netfs_write_begin()--\u0026gt; netfs_begin_read()--\u0026gt; netfs_rreq_submit_slice()--\u0026gt; netfs_read_from_server()--\u0026gt; rreq-\u0026gt;netfs_ops-\u0026gt;issue_read()--\u0026gt; ceph_netfs_issue_read()--\u0026gt; { ... if (ci-\u0026gt;i_inline_version != CEPH_INLINE_NONE \u0026amp;\u0026amp; ceph_netfs_issue_op_inline(subreq)) return; ... } ceph_put_cap_refs(ci, Fwb); El ceph_netfs_issue_op_inline() enviar\u00e1 una solicitud getattr(Fsr) a mds.1.4, luego mds.1 solicitar\u00e1 el bloqueo de rd para CInode::filelock desde el mds.0 de autenticaci\u00f3n, el mds.0 realizar\u00e1 la transacci\u00f3n de estado de CInode::filelock desde excl --\u0026gt; sync, pero necesita revocar las capacidades Fxwb de los clientes. Mientras que el cliente del kernel ya ha retenido las capacidades Fwb y est\u00e1 esperando el getattr(Fsr). \u00a1Est\u00e1 en un punto muerto! URL: https://tracker.ceph.com/issues/55377\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/addr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"083db6fd3e73fc4f9ee74d2da1012a94216d6a60\",\"lessThan\":\"292b7a7275ce535a1abfa4dd0b2e586162aaae1e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"083db6fd3e73fc4f9ee74d2da1012a94216d6a60\",\"lessThan\":\"825978fd6a0defc3c29d8a38b6cea76a0938d21e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/addr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.4\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:44:59.503744Z\",\"id\":\"CVE-2022-49296\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.34\",\"versionEndExcluding\":\"5.18.4\",\"matchCriteriaId\":\"48912B8B-BDF1-422C-9CA5-2DDFDBAADC80\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/292b7a7275ce535a1abfa4dd0b2e586162aaae1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/825978fd6a0defc3c29d8a38b6cea76a0938d21e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:04:01+00:00",
      "cve": "CVE-2022-49296",
      "id": "CVE-2022-49296",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: fix possible deadlock when holding Fwb to get inline_data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49296.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:29:00Z",
      "cve": "CVE-2022-49296",
      "id": "CVE-2022-49296",
      "initial_release_date": "2025-02-27T03:09:15Z",
      "product_status:known_affected": "376",
      "product_status:known_not_affected": "506",
      "product_status:recommended": "100",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49296",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49296.json",
      "version": "52"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49296\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:44:59.503744Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-667\", \"description\": \"CWE-667 Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:13:13.291Z\"}}], \"cna\": {\"title\": \"ceph: fix possible deadlock when holding Fwb to get inline_data\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"083db6fd3e73fc4f9ee74d2da1012a94216d6a60\", \"lessThan\": \"292b7a7275ce535a1abfa4dd0b2e586162aaae1e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"083db6fd3e73fc4f9ee74d2da1012a94216d6a60\", \"lessThan\": \"825978fd6a0defc3c29d8a38b6cea76a0938d21e\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ceph/addr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.18.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ceph/addr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/292b7a7275ce535a1abfa4dd0b2e586162aaae1e\"}, {\"url\": \"https://git.kernel.org/stable/c/825978fd6a0defc3c29d8a38b6cea76a0938d21e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix possible deadlock when holding Fwb to get inline_data\\n\\n1, mount with wsync.\\n2, create a file with O_RDWR, and the request was sent to mds.0:\\n\\n   ceph_atomic_open()--\u003e\\n     ceph_mdsc_do_request(openc)\\n     finish_open(file, dentry, ceph_open)--\u003e\\n       ceph_open()--\u003e\\n         ceph_init_file()--\u003e\\n           ceph_init_file_info()--\u003e\\n             ceph_uninline_data()--\u003e\\n             {\\n               ...\\n               if (inline_version == 1 || /* initial version, no data */\\n                   inline_version == CEPH_INLINE_NONE)\\n                     goto out_unlock;\\n               ...\\n             }\\n\\nThe inline_version will be 1, which is the initial version for the\\nnew create file. And here the ci-\u003ei_inline_version will keep with 1,\\nit\u0027s buggy.\\n\\n3, buffer write to the file immediately:\\n\\n   ceph_write_iter()--\u003e\\n     ceph_get_caps(file, need=Fw, want=Fb, ...);\\n     generic_perform_write()--\u003e\\n       a_ops-\u003ewrite_begin()--\u003e\\n         ceph_write_begin()--\u003e\\n           netfs_write_begin()--\u003e\\n             netfs_begin_read()--\u003e\\n               netfs_rreq_submit_slice()--\u003e\\n                 netfs_read_from_server()--\u003e\\n                   rreq-\u003enetfs_ops-\u003eissue_read()--\u003e\\n                     ceph_netfs_issue_read()--\u003e\\n                     {\\n                       ...\\n                       if (ci-\u003ei_inline_version != CEPH_INLINE_NONE \u0026\u0026\\n                           ceph_netfs_issue_op_inline(subreq))\\n                         return;\\n                       ...\\n                     }\\n     ceph_put_cap_refs(ci, Fwb);\\n\\nThe ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to\\nmds.1.\\n\\n4, then the mds.1 will request the rd lock for CInode::filelock from\\nthe auth mds.0, the mds.0 will do the CInode::filelock state transation\\nfrom excl --\u003e sync, but it need to revoke the Fxwb caps back from the\\nclients.\\n\\nWhile the kernel client has aleady held the Fwb caps and waiting for\\nthe getattr(Fsr).\\n\\nIt\u0027s deadlock!\\n\\nURL: https://tracker.ceph.com/issues/55377\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.4\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-12T23:58:22.125Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49296\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T23:58:22.125Z\", \"dateReserved\": \"2025-02-26T01:49:39.302Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:01:26.131Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.