{"cve":"CVE-2022-49699","nvd":{"published":"2025-02-26T07:01:44.640","modified":"2026-06-17T05:18:53.970","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: Handle sibling entries in filemap_get_read_batch()\n\nIf a read races with an invalidation followed by another read, it is\npossible for a folio to be replaced with a higher-order folio.  If that\nhappens, we'll see a sibling entry for the new folio in the next iteration\nof the loop.  This manifests as a NULL pointer dereference while holding\nthe RCU read lock.\n\nHandle this by simply returning.  The next call will find the new folio\nand handle it correctly.  The other ways of handling this rare race are\nmore complex and it's just not worth it.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/a66f131d30e53000f08301776bf85c912ef47aad","https://git.kernel.org/stable/c/cb995f4eeba9d268fd4b56c2423ad6c1d1ea1b82"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2022-49699","score":0.00228,"percentile":0.13683,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}