CVE-2022-49030

HighCVSS 7.8

Published: 21/10/2024(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

In the libbpf library in the Linux kernel, a size overflow issue was found when mapping ringbuf memory. The maximum ringbuf size on x86-64 hosts is 2GB, so 2 * max_entries can overflow u32 when mapping producer and data pages. The fix casts the size of the read-only mmap region to __u64 and checks for overflow during mmap.

Risk Assessment

Size overflow can lead to incorrect memory mapping, potentially causing application errors when using ringbuf, and in extreme cases memory corruption.

Recommendation

It is recommended to update the Linux kernel to a version containing the fix for CVE-2022-49030. Also, avoid using very large ringbuf sizes in 32-bit applications on 64-bit kernels.

Other vulnerabilities in libbpf

CVE-2026-80675High
In libbpf, the signed loader does not ensure that a map is exclusive before validating map->sha. Without exclusivity, another BPF program with map access can mutate the contents after freezing, allowing validation on stale data. The fix adds an exclusivity check.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_t is not enough, because for 32-bits application on 64-bits kernel the size of read-only mmap region also could overflow size_t. So fixing it by casting the size of read-only mmap region into a __u64 and checking whether or not there will be overflow during mmap.