CVE-2022-49058
A buffer overflow in the Linux kernel’s CIFS module can be triggered by malicious symlinks. An attacker can crash the kernel, causing a denial of service. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including version 5.18 and other affected releases. Typical users are Linux system administrators and end‑users who run these kernels and use CIFS file shares.
Real-world impact
An attacker could crash the kernel, forcing the system to reboot or become unresponsive, effectively denying service to legitimate users.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely without authentication, leading to a complete loss of availability. The lack of required privileges or user interaction makes it highly dangerous.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2022-49058.
- 02Restart the system to load the new kernel.
NVD description indicates the vulnerability has been resolved.
Timeline
- Feb 26, 2025 · Feb 26, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/1316c28569a80ab359…patch
- git.kernel.org/stable/c/22d658c6c5affed10c…patch
- git.kernel.org/stable/c/3e582749e742e662a8…patch
- git.kernel.org/stable/c/4e166a41180be2f1e6…patch
- git.kernel.org/stable/c/515e7ba11ef043d6fe…patch
- git.kernel.org/stable/c/64c4a37ac04eeb43c4…patch
- git.kernel.org/stable/c/9901b07ba42b39266b…patch
- git.kernel.org/stable/c/eb5f51756944735ac7…patch