LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49526: md/bitmap: don't set sb values if can't pass sanity check

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: don't set sb values if can't pass sanity check If bitmap area contains invalid data, kernel will crash then mdadm triggers "Segmentation fault". This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info. But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed. How to trigger: (faulty injection) dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss echo aaa > magic.txt == below modifying slot 2 bitmap data == dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb == kernel crashes. mdadm outputs "Segmentation fault" == Reason of kernel crash: In md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't block chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T() trigger "divide error". Crash log: kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: md_bitmap_copy_from_slot can't get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ... ... kernel: Call Trace: kernel: ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0] kernel: md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a] kernel: load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0] kernel: md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a] kernel: do_md_run+0x30/0x100 [md_mod 24ea..d3a] kernel: md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a] kernel: ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a] kernel: ? blkdev_ioctl+0xb1/0x2b0 kernel: block_ioctl+0x3b/0x40 kernel: __x64_sys_ioctl+0x7f/0xb0 kernel: do_syscall_64+0x59/0x80 kernel: ? exit_to_user_mode_prepare+0x1ab/0x230 kernel: ? syscall_exit_to_user_mode+0x18/0x40 kernel: ? do_syscall_64+0x69/0x80 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49526 is a Linux kernel crash issue in clustered software RAID bitmap handling. If corrupted bitmap metadata is present, assembling a clustered md array can trigger a kernel divide error. The business impact is availability loss on affected storage nodes, not documented data theft or remote compromise.

Executive priority

Treat as a targeted availability risk for clustered Linux software RAID environments. It is not currently supported as internet-exploited or remotely exploitable by the provided sources. Prioritize storage clusters where kernel crashes would disrupt critical services.

Technical view

The flaw is in Linux md/bitmap handling for cluster-md. Bad bitmap magic did not prevent superblock fields, including chunksize, from being used. A zero chunksize can cause a divide error in md_bitmap_create during clustered bitmap loading. Sources describe non-clustered environments as handling broken metadata differently.

Likely exposure

Exposure appears limited to Linux systems using mdadm clustered md arrays with bitmap metadata. Systems not using clustered md are less likely to be affected based on the CVE description. Version data in the source lists Linux kernel versions including 3.5 and multiple stable lines through 5.19 as affected.

Exploitation context

No KEV listing or cited source indicates active exploitation. The public description demonstrates a crash through deliberate corruption of bitmap metadata, followed by mdadm assembly. Practical exploitation likely requires the ability to alter RAID member metadata or storage contents.

Researcher notes

The fix theme is defensive parsing: do not set bitmap superblock values when sanity checks fail. Key path described is md_bitmap_read_sb to md_bitmap_create, reached through clustered bitmap loading. Evidence is strongest for crash impact; privilege boundary and exact distro package status require vendor confirmation.

Mitigation direction

  • Update Linux kernels using vendor packages that include the referenced stable fixes.
  • Prioritize clustered md or mdadm storage nodes for review and maintenance.
  • Protect RAID member devices and metadata from unauthorized write access.
  • If vendor fix status is unclear, check distribution kernel advisories for CVE-2022-49526.

Validation and detection

  • Inventory Linux hosts using mdadm clustered arrays or md-cluster.
  • Compare running kernel builds against vendor advisories and referenced stable commits.
  • Review kernel logs for md-cluster bitmap errors, invalid bitmap superblocks, or divide errors.
  • Confirm patched test systems can assemble valid clustered arrays without regression.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49526 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxef99bf480de9bde9d3b2afdf05324670fab4e571, ef99bf480de9bde9d3b2afdf05324670fab4e571, ef99bf480de9bde9d3b2afdf05324670fab4e571, ef99bf480de9bde9d3b2afdf05324670fab4e571, ef99bf480de9bde9d3b2afdf05324670fab4e571, ef99bf480de9bde9d3b2afdf05324670fab4e571, ef99bf480de9bde9d3b2afdf05324670fab4e571unaffected
LinuxLinux3.5, 0, 4.19.247, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.