CVE-2022-49281 [Medium] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: cifs: fix handlecache and multiuser In multiuser each individual user has their own tcon structure for the share and thus their own handle for a cached directory. When we umount such a share we much make sure to release the pinned down dentry for each such tcon and not just the master tcon. Otherwise we will get nasty warnings on umount that dentries are still in use: [ 3459.590047] BUG: Dentry 00000000115c6f41{i=12000000019d95,n=/} still in use\ (2) [unmount of cifs cifs] ... [ 3459.590492] Call Trace: [ 3459.590500] d_walk+0x61/0x2a0 [ 3459.590518] ? shrink_lock_dentry.part.0+0xe0/0xe0 [ 3459.590526] shrink_dcache_for_umount+0x49/0x110 [ 3459.590535] generic_shutdown_super+0x1a/0x110 [ 3459.590542] kill_anon_super+0x14/0x30 [ 3459.590549] cifs_kill_sb+0xf5/0x104 [cifs] [ 3459.590773] deactivate_locked_super+0x36/0xa0 [ 3459.590782] cleanup_mnt+0x131/0x190 [ 3459.590789] task_work_run+0x5c/0x90 [ 3459.590798] exit_to_user_mode_loop+0x151/0x160 [ 3459.590809] exit_to_user_mode_prepare+0x83/0xd0 [ 3459.590818] syscall_exit_to_user_mode+0x12/0x30 [ 3459.590828] do_syscall_64+0x48/0x90 [ 3459.590833] entry_SYSCALL_64_after_hwframe+0x44/0xae

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-10-22	0.05%	0.03%	-0.02%
2	2025-10-02	0.04%	0.05%	+0.01%
3	2025-02-27	—	0.04%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-10-22

0.05%

0.03%

-0.02%

2025-10-02

0.04%

0.05%

+0.01%

2025-02-27

—

0.04%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.5	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.5

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

3.6

[email protected]

OS Trackers for CVE-2022-49281

vendor	priority	summary	link
`debian`	unimportant	CVE-2022-49281 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2022-49281
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2022-49281
`suse`	medium	—	https://www.suse.com/security/cve/CVE-2022-49281/
`ubuntu`	medium	CVE-2022-49281 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1551 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1145, ignored 150, released 108, not-affected 106, needed 42.	https://ubuntu.com/security/CVE-2022-49281

Affected software / configurations for CVE-2022-49281

Vendor	Product	Version	Raw CPE
linux	linux_kernel	< 5.15.33	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.16, < 5.16.19	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 5.17, < 5.17.2	cpe:2.3:o:linux:linux_kernel::::::::

References for CVE-2022-49281

URL	Tags
https://git.kernel.org/stable/c/2fafbc198613823943c106d1ec9b516da692059f	Patch
https://git.kernel.org/stable/c/47178c7722ac528ea08aa82c3ef9ffa178962d7a	Patch
https://git.kernel.org/stable/c/e71f6a3a1d5c826a30384fec587ca7503ef6bde5	Patch
https://git.kernel.org/stable/c/ffa631c4bff59dde59b598011f570e27dfba3515	Patch

URL

CVE-2022-49281 | cifs: fix handlecache and multiuser

Exploit prediction scoring system (EPSS) score for CVE-2022-49281

Common vulnerability scoring system (CVSS) metrics for CVE-2022-49281

Weakness enumeration for CVE-2022-49281

OS Trackers for CVE-2022-49281

Affected software / configurations for CVE-2022-49281

References for CVE-2022-49281