CVE-2022-49625
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
26/02/2025
Last modified:
23/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
sfc: fix kernel panic when creating VF<br />
<br />
When creating VFs a kernel panic can happen when calling to<br />
efx_ef10_try_update_nic_stats_vf.<br />
<br />
When releasing a DMA coherent buffer, sometimes, I don&#39;t know in what<br />
specific circumstances, it has to unmap memory with vunmap. It is<br />
disallowed to do that in IRQ context or with BH disabled. Otherwise, we<br />
hit this line in vunmap, causing the crash:<br />
BUG_ON(in_interrupt());<br />
<br />
This patch reenables BH to release the buffer.<br />
<br />
Log messages when the bug is hit:<br />
kernel BUG at mm/vmalloc.c:2727!<br />
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI<br />
CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1<br />
Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020<br />
RIP: 0010:vunmap+0x2e/0x30<br />
...skip...<br />
Call Trace:<br />
__iommu_dma_free+0x96/0x100<br />
efx_nic_free_buffer+0x2b/0x40 [sfc]<br />
efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc]<br />
efx_ef10_update_stats_vf+0x18/0x40 [sfc]<br />
efx_start_all+0x15e/0x1d0 [sfc]<br />
efx_net_open+0x5a/0xe0 [sfc]<br />
__dev_open+0xe7/0x1a0<br />
__dev_change_flags+0x1d7/0x240<br />
dev_change_flags+0x21/0x60<br />
...skip...
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.2 (including) | 4.9.324 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.10 (including) | 4.14.289 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.15 (including) | 4.19.253 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.20 (including) | 5.4.207 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.5 (including) | 5.10.132 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.56 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 5.18.13 (excluding) |
| cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf103a
- https://git.kernel.org/stable/c/68e5f32f0de9594629ff9e599294d9801c6187de
- https://git.kernel.org/stable/c/82bcb730f856086f033e6c04082eb4503d4c2fa4
- https://git.kernel.org/stable/c/ada74c5539eba06cf8b47d068f92e0b3963a9a6e
- https://git.kernel.org/stable/c/b82e4ad58a7fb72456503958a93060f87896e629
- https://git.kernel.org/stable/c/b9072305270579a9d6afc9b926166231e5b1a7c8
- https://git.kernel.org/stable/c/d9840212a9c00507347c703f4fdeda16400407e0
- https://git.kernel.org/stable/c/da346adcf5573fd8663cabfdfe8371009629a906



