CVE-2022-50058

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
18/06/2025
Last modified:
13/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vdpa_sim_blk: set number of address spaces and virtqueue groups<br /> <br /> Commit bda324fd037a ("vdpasim: control virtqueue support") added two<br /> new fields (nas, ngroups) to vdpasim_dev_attr, but we forgot to<br /> initialize them for vdpa_sim_blk.<br /> <br /> When creating a new vdpa_sim_blk device this causes the kernel<br /> to panic in this way:<br />    $ vdpa dev add mgmtdev vdpasim_blk name blk0<br />    BUG: kernel NULL pointer dereference, address: 0000000000000030<br />    ...<br />    RIP: 0010:vhost_iotlb_add_range_ctx+0x41/0x220 [vhost_iotlb]<br />    ...<br />    Call Trace:<br />     <br />     vhost_iotlb_add_range+0x11/0x800 [vhost_iotlb]<br />     vdpasim_map_range+0x91/0xd0 [vdpa_sim]<br />     vdpasim_alloc_coherent+0x56/0x90 [vdpa_sim]<br />     ...<br /> <br /> This happens because vdpasim-&gt;iommu[0] is not initialized when<br /> dev_attr.nas is 0.<br /> <br /> Let&amp;#39;s fix this issue by initializing both (nas, ngroups) to 1 for<br /> vdpa_sim_blk.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.19 (including) 5.19.4 (excluding)