Linux Kernel up to 5.18.2 host/mmci.c stack-based overflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.4.197/5.10.120/5.15.45/5.17.13/5.18.2. It has been classified as critical. This affects an unknown function of the file host/mmci.c. This manipulation causes stack-based overflow. This vulnerability is registered as CVE-2022-49522. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 5.4.197/5.10.120/5.15.45/5.17.13/5.18.2 and classified as critical. Affected by this vulnerability is an unknown code block of the file host/mmci.c. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Do what is done in other DMA-enabled MMC host drivers (cf. host/mmci.c) and limit the maximum segment size based on the DMA engine's capabilities. This is needed to avoid warnings like the following with CONFIG_DMA_API_DEBUG=y. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 21 at kernel/dma/debug.c:1162 debug_dma_map_sg+0x2f4/0x39c DMA-API: jz4780-dma 13420000.dma-controller: mapping sg segment longer than device claims to support [len=98304] [max=65536] CPU: 0 PID: 21 Comm: kworker/0:1H Not tainted 5.18.0-rc1 #19 Workqueue: kblockd blk_mq_run_work_fn Stack : 81575aec 00000004 80620000 80620000 80620000 805e7358 00000009 801537ac 814c832c 806276e3 806e34b4 80620000 81575aec 00000001 81575ab8 09291444 00000000 00000000 805e7358 81575958 ffffffea 8157596c 00000000 636f6c62 6220646b 80387a70 0000000f 6d5f6b6c 80620000 00000000 81575ba4 00000009 805e170c 80896640 00000001 00010000 00000000 00000000 00006098 806e0000 ... Call Trace: [] show_stack+0x84/0x120 [] __warn+0xb8/0xec [] warn_slowpath_fmt+0x6c/0xb8 [] debug_dma_map_sg+0x2f4/0x39c [] __dma_map_sg_attrs+0xf0/0x118 [] dma_map_sg_attrs+0x14/0x28 [] jz4740_mmc_prepare_dma_data+0x74/0xa4 [] jz4740_mmc_pre_request+0x30/0x54 [] mmc_blk_mq_issue_rq+0x6e0/0x7bc [] mmc_mq_queue_rq+0x220/0x2d4 [] blk_mq_dispatch_rq_list+0x480/0x664 [] blk_mq_do_dispatch_sched+0x2dc/0x370 [] __blk_mq_sched_dispatch_requests+0xec/0x164 [] blk_mq_sched_dispatch_requests+0x44/0x94 [] __blk_mq_run_hw_queue+0xb0/0xcc [] process_one_work+0x1b8/0x264 [] worker_thread+0x2ec/0x3b8 [] kthread+0x104/0x10c [] ret_from_kernel_thread+0x14/0x1c ---[ end trace 0000000000000000 ]---

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2022-49522 since 02/26/2025. The exploitation appears to be easy. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2025).

Upgrading to version 5.4.198, 5.10.121, 5.15.46, 5.17.14 or 5.18.3 eliminates this vulnerability. Applying the patch 7923f95997a79cef2ad161a2facae64c25a0bca0/90281cadf5077f2d2bec8b08c2ead1f8cd12660e/353298cadbd4c7d8e8a16d6000066414694933c3/807f90f1960a59dc557542b818c484a8db9ac978/a828920b9ec0d89d3011198d482b7fe224d2de19/afadb04f1d6e74b18a253403f5274cde5e3fd7bd is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.197
• 5.10.120
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.15.34
• 5.15.35
• 5.15.36
• 5.15.37
• 5.15.38
• 5.15.39
• 5.15.40
• 5.15.41
• 5.15.42
• 5.15.43
• 5.15.44
• 5.15.45
• 5.17.0
• 5.17.1
• 5.17.2
• 5.17.3
• 5.17.4
• 5.17.5
• 5.17.6
• 5.17.7
• 5.17.8
• 5.17.9
• 5.17.10
• 5.17.11
• 5.17.12
• 5.17.13
• 5.18.0
• 5.18.1
• 5.18.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion