CVE-2022-49541

A flaw was found in the Linux kernel's CIFS code in which a failed mount might lead to a double-free. An attacker with permissions to attempt to mount CIFS volumes could exploit this vulnerability to alter kernel memory, leading to a denial of service, altered system memory, or an escalation of privileges.

This flaw results from a missing check in the kernel's CIFS mounting code which can lead to the same pointer being freed twice when there is an error mounting the volume. An attacker could exploit this vulnerability to corrupt or alter system memory or execute arbitrary code with elevated privileges. Note that this vulnerability was fixed in previous errata: RHSA-2022:5819 for Red Hat Enterprise Linux 8.6 EUS RHSA-2022:7683 for Red Hat Enterprise Linux 8.7-8.10 RHSA-2023:2458 for Red Hat Enterprise Linux 9.2 and later.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.