CVE-2022-49626 Details
Description
In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov and later read in efx_ef10_sriov_free_vf_vports, called from efx_ef10_sriov_free_vf_vswitching. Set the pointer to NULL at release time to not trying to read it later. Reproducer and dmesg log (note that kfence doesn't detect it every time): $ echo 1 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs $ echo 0 > /sys/class/net/enp65s0f0np0/device/sriov_numvfs BUG: KFENCE: use-after-free read in efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] Use-after-free read at 0x00000000ff3c1ba5 (in kfence-#224): efx_ef10_sriov_free_vf_vswitching+0x82/0x170 [sfc] efx_ef10_pci_sriov_disable+0x38/0x70 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xfe/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae kfence-#224: 0x00000000edb8ef95-0x00000000671f5ce1, size=2792, cache=kmalloc-4k allocated by task 6771 on cpu 10 at 3137.860196s: pci_alloc_dev+0x21/0x60 pci_iov_add_virtfn+0x2a2/0x320 sriov_enable+0x212/0x3e0 efx_ef10_sriov_configure+0x67/0x80 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xba/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae freed by task 6771 on cpu 12 at 3170.991309s: device_release+0x34/0x90 kobject_cleanup+0x3a/0x130 pci_iov_remove_virtfn+0xd9/0x120 sriov_disable+0x30/0xe0 efx_ef10_pci_sriov_disable+0x57/0x70 [sfc] efx_pci_sriov_configure+0x24/0x40 [sfc] sriov_numvfs_store+0xfe/0x140 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
A use-after-free vulnerability has been identified in the Linux kernel's SFC network driver, specifically related to SR-IOV (Single Root I/O Virtualization) management. This vulnerability occurs when virtual functions (VFs) are disabled, leading to a premature release of memory that is still being accessed. The issue was detected by KFENCE, a kernel memory error detection tool, which reported a use-after-free read in the SR-IOV virtual switching function. The vulnerability arises because the pointer to the PCI device of the virtual function is read after it has been freed, creating a potential for memory corruption or exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/3199e34912d84cdfb8a93a984c5ae5c73fb13e84 | kernel.org | Patch |
| https://git.kernel.org/stable/c/58d93e9d160c0de6d867c7eb4c2206671a351eb1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9c854ae512b89229aeee93849e9bd4c115b37909 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bcad880865bfb421885364b1f0c7351280fe2b97 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c2240500817b3b4b996cdf2a461a3a5679f49b94 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c9e75bb22a26e391f189f5a5133dd63dcb57fdaa | kernel.org | Patch |
| https://git.kernel.org/stable/c/e435c4aeeaa073091f7f3b7735af2ef5c97d63f2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ebe41da5d47ac0fff877e57bd14c54dccf168827 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.2, < 4.9.324 >= 4.10, < 4.14.289 >= 4.15, < 4.19.253 >= 4.20, < 5.4.207 >= 5.5, < 5.10.132 >= 5.11, < 5.15.56 >= 5.16, < 5.18.13 5.19 rc1 5.19 rc2 5.19 rc3 5.19 rc4 5.19 rc5 5.19 rc6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2025 | Initial Analysis | [email protected] |
| Feb 27, 2025 | CVE Modified | CISA-ADP |
| Feb 26, 2025 | New CVE Received | kernel.org |