Wiz
Vulnerability DatabaseCVE-2022-49743

CVE-2022-49743: 
Linux Kernel vulnerability analysis and mitigation

Overview

CVE-2022-49743 affects the Linux kernel and involves a vulnerability in the overlayfs (ovl) component. The issue was discovered in the flexible array handling for memcpy() destination in the filesystem's export functionality (NVD).

Technical details

The vulnerability relates to the 'buf' flexible array implementation in the overlayfs component of the Linux kernel. Specifically, the issue occurs when the 'buf' flexible array is not properly used as the memcpy() destination, which can trigger false positive run-time warnings from FORTIFY_SOURCE hardening. The warning appears at fs/overlayfs/export.c:799 regarding a field-spanning write of size 93 to a single field '&fh->fb' of size 21 (NVD).

Impact

The vulnerability affects various Linux distributions, including Debian bullseye (5.10.223-1 and 5.10.234-1) which were marked as vulnerable, while later versions in bookworm (6.1.128-1 and newer) and sid/trixie (6.12.21-1) contained fixes (Debian Tracker).

Mitigation and workarounds

The issue has been resolved in newer kernel versions. Debian has implemented fixes in bookworm (6.1.128-1 and later) and sid/trixie (6.12.21-1) releases. Users should upgrade to these patched versions to mitigate the vulnerability (Debian Tracker).

Additional resources

Source: This report was generated using AI

Related Linux Kernel vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-40344N/AN/A
  • Linux KernelLinux Kernel
  • kernel-debug-modules-internal
NoYesDec 09, 2025
CVE-2025-40343N/AN/A
  • Linux KernelLinux Kernel
  • kernel-64k-debug-devel
NoYesDec 09, 2025
CVE-2025-40342N/AN/A
  • Linux KernelLinux Kernel
  • kernel-64k-debug-devel-matched
NoYesDec 09, 2025
CVE-2025-40341N/AN/A
  • Linux KernelLinux Kernel
  • kernel-rt-64k-debug-modules-extra
NoYesDec 09, 2025
CVE-2025-40340N/AN/A
  • Linux KernelLinux Kernel
  • kernel-rt-64k-debug-kvm
NoYesDec 09, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo