CVE-2022-50058
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
18/06/2025
Last modified:
13/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
vdpa_sim_blk: set number of address spaces and virtqueue groups<br />
<br />
Commit bda324fd037a ("vdpasim: control virtqueue support") added two<br />
new fields (nas, ngroups) to vdpasim_dev_attr, but we forgot to<br />
initialize them for vdpa_sim_blk.<br />
<br />
When creating a new vdpa_sim_blk device this causes the kernel<br />
to panic in this way:<br />
$ vdpa dev add mgmtdev vdpasim_blk name blk0<br />
BUG: kernel NULL pointer dereference, address: 0000000000000030<br />
...<br />
RIP: 0010:vhost_iotlb_add_range_ctx+0x41/0x220 [vhost_iotlb]<br />
...<br />
Call Trace:<br />
<br />
vhost_iotlb_add_range+0x11/0x800 [vhost_iotlb]<br />
vdpasim_map_range+0x91/0xd0 [vdpa_sim]<br />
vdpasim_alloc_coherent+0x56/0x90 [vdpa_sim]<br />
...<br />
<br />
This happens because vdpasim->iommu[0] is not initialized when<br />
dev_attr.nas is 0.<br />
<br />
Let&#39;s fix this issue by initializing both (nas, ngroups) to 1 for<br />
vdpa_sim_blk.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.19 (including) | 5.19.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



