CVE-2022-49548 bpf: Fix potential array overflow in bpf_trampoline_get_progs()
A logic error in the Linux kernel BPF trampoline allows array overflow, potentially enabling local attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49548?
CVE-2022-49548 is a high-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline can exceed BPF_MAX_TRAMP_PROGS.
When this happens, the assignment '*progs++ = aux->prog' in bpf_trampoline_get_progs() will cause progs array overflow as the progs field in the bpf_tramp_progs struct can only hold at most BPF_MAX_TRAMP_PROGS bpf programs.
Weakness: CWE-129
Which versions are affected by CVE-2022-49548?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49548?
Apply the vendor's patch.
Is CVE-2022-49548 being exploited?
There is no known exploitation of CVE-2022-49548 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49548, GHSA-v45j-q282-89r5, UBUNTU-CVE-2022-49548.