CVE-2022-49625
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
sfc: fix kernel panic when creating VF
When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf.
When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has to unmap memory with vunmap. It is disallowed to do that in IRQ context or with BH disabled. Otherwise, we hit this line in vunmap, causing the crash: BUG_ON(in_interrupt());
This patch reenables BH to release the buffer.
Detalles técnicos trazas, registros y código del informe original
Log messages when the bug is hit: kernel BUG at mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: __iommu_dma_free+0x96/0x100 efx_nic_free_buffer+0x2b/0x40 [sfc] efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] efx_ef10_update_stats_vf+0x18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d7/0x240 dev_change_flags+0x21/0x60 ...skip...
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.29%
- Percentil entre todas las CVEs puntuadas: 19
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
- https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf103a
- https://git.kernel.org/stable/c/68e5f32f0de9594629ff9e599294d9801c6187de
- https://git.kernel.org/stable/c/82bcb730f856086f033e6c04082eb4503d4c2fa4
- https://git.kernel.org/stable/c/ada74c5539eba06cf8b47d068f92e0b3963a9a6e
- https://git.kernel.org/stable/c/b82e4ad58a7fb72456503958a93060f87896e629
- https://git.kernel.org/stable/c/b9072305270579a9d6afc9b926166231e5b1a7c8
- https://git.kernel.org/stable/c/d9840212a9c00507347c703f4fdeda16400407e0
- https://git.kernel.org/stable/c/da346adcf5573fd8663cabfdfe8371009629a906
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-49625",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "d9840212a9c00507347c703f4fdeda16400407e0",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "b9072305270579a9d6afc9b926166231e5b1a7c8",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "82bcb730f856086f033e6c04082eb4503d4c2fa4",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "da346adcf5573fd8663cabfdfe8371009629a906",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "b82e4ad58a7fb72456503958a93060f87896e629",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "68e5f32f0de9594629ff9e599294d9801c6187de",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "16662524ec5da801fb78a1afcaf6e782f1cf103a",
"versionType": "git"
},
{
"status": "affected",
"version": "d778819609a27efd5358da8151a0ad3507243e19",
"lessThan": "ada74c5539eba06cf8b47d068f92e0b3963a9a6e",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/sfc/ef10.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.9.324",
"versionType": "semver",
"lessThanOrEqual": "4.9.*"
},
{
"status": "unaffected",
"version": "4.14.289",
"versionType": "semver",
"lessThanOrEqual": "4.14.*"
},
{
"status": "unaffected",
"version": "4.19.253",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.207",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.132",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.56",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "5.18.13",
"versionType": "semver",
"lessThanOrEqual": "5.18.*"
},
{
"status": "unaffected",
"version": "5.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/sfc/ef10.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-02-26T07:01:37.847",
"references": [
{
"url": "https://git.kernel.org/stable/c/16662524ec5da801fb78a1afcaf6e782f1cf103a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68e5f32f0de9594629ff9e599294d9801c6187de",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/82bcb730f856086f033e6c04082eb4503d4c2fa4",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ada74c5539eba06cf8b47d068f92e0b3963a9a6e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b82e4ad58a7fb72456503958a93060f87896e629",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b9072305270579a9d6afc9b926166231e5b1a7c8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d9840212a9c00507347c703f4fdeda16400407e0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da346adcf5573fd8663cabfdfe8371009629a906",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: fix kernel panic when creating VF\n\nWhen creating VFs a kernel panic can happen when calling to\nefx_ef10_try_update_nic_stats_vf.\n\nWhen releasing a DMA coherent buffer, sometimes, I don't know in what\nspecific circumstances, it has to unmap memory with vunmap. It is\ndisallowed to do that in IRQ context or with BH disabled. Otherwise, we\nhit this line in vunmap, causing the crash:\n BUG_ON(in_interrupt());\n\nThis patch reenables BH to release the buffer.\n\nLog messages when the bug is hit:\n kernel BUG at mm/vmalloc.c:2727!\n invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1\n Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020\n RIP: 0010:vunmap+0x2e/0x30\n ...skip...\n Call Trace:\n __iommu_dma_free+0x96/0x100\n efx_nic_free_buffer+0x2b/0x40 [sfc]\n efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc]\n efx_ef10_update_stats_vf+0x18/0x40 [sfc]\n efx_start_all+0x15e/0x1d0 [sfc]\n efx_net_open+0x5a/0xe0 [sfc]\n __dev_open+0xe7/0x1a0\n __dev_change_flags+0x1d7/0x240\n dev_change_flags+0x21/0x60\n ...skip..."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sfc: corregir pánico del kernel al crear VF Al crear VF, puede ocurrir un pánico del kernel al llamar a efx_ef10_try_update_nic_stats_vf. Al liberar un búfer coherente DMA, a veces, no sé en qué circunstancias específicas, tiene que desasignar la memoria con vunmap. No está permitido hacer eso en el contexto de IRQ o con BH deshabilitado. De lo contrario, llegamos a esta línea en vunmap, lo que provoca el bloqueo: BUG_ON(in_interrupt()); Este parche vuelve a habilitar BH para liberar el búfer. Mensajes de registro cuando se detecta el error: kernel BUG en mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: __iommu_dma_free+0x96/0x100 efx_nic_free_buffer+0x2b/0x40 [sfc] efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] efx_ef10_update_stats_vf+0x18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d7/0x240 dev_change_flags+0x21/0x60 ...skip... "
}
],
"lastModified": "2026-06-17T05:18:39.893",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2423841B-6626-4BBC-967E-B6216D5DB225",
"versionEndExcluding": "4.9.324",
"versionStartIncluding": "4.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9209AEEF-782D-43E6-AA5C-9F5B9CD6ED11",
"versionEndExcluding": "4.14.289",
"versionStartIncluding": "4.10"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B22ACD7-9025-4AD5-AD6E-A929DEC79B75",
"versionEndExcluding": "4.19.253",
"versionStartIncluding": "4.15"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C27A52F3-82C8-4F03-BE80-38D11CDBD503",
"versionEndExcluding": "5.4.207",
"versionStartIncluding": "4.20"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46CE9FE9-22E3-45CA-8B5F-190C2CAFC5CE",
"versionEndExcluding": "5.10.132",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF59CE2F-BA66-4BFD-83AB-4576F3D1B49A",
"versionEndExcluding": "5.15.56",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "640221A7-96EE-4B48-8FE1-BA810131789B",
"versionEndExcluding": "5.18.13",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00AE778B-BAEE-49EB-9F84-003B73D7862A"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}