CVE-2022-49300 (GCVE-0-2022-49300)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:10 – Updated: 2026-05-11 18:57
VLAI
Title
nbd: fix race between nbd_alloc_config() and module removal
Summary
In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between nbd_alloc_config() and module removal When nbd module is being removing, nbd_alloc_config() may be called concurrently by nbd_genl_connect(), although try_module_get() will return false, but nbd_alloc_config() doesn't handle it. The race may lead to the leak of nbd_config and its related resources (e.g, recv_workq) and oops in nbd_read_stat() due to the unload of nbd module as shown below: BUG: kernel NULL pointer dereference, address: 0000000000000040 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: knbd16-recv recv_work [nbd] RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd] Call Trace: recv_work+0x3b/0xb0 [nbd] process_one_work+0x1ed/0x390 worker_thread+0x4a/0x3d0 kthread+0x12a/0x150 ret_from_fork+0x22/0x30 Fixing it by checking the return value of try_module_get() in nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV), assign nbd->config only when nbd_alloc_config() succeeds to ensure the value of nbd->config is binary (valid or NULL). Also adding a debug message to check the reference counter of nbd_config during module removal.
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:44 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < 165cf2e0019fa6cedc75b456490c41494c34abb4 (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < 2573f2375b64280be977431701ed5d33b75b9ad0 (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < 8a7da4ced236ce6637fe70f14ca18e718d4bf9e9 (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < 122e4adaff2439f1cc18cc7e931980fa7560df5c (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < 71c142f910da44421213ade601bcbd23ceae19fa (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < 2888fa41985f93ed0a6837cfbb06bcbfd7fa2314 (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < d09525720dd5201756f698bee1076de9aefd4602 (git)
Affected: 5ea8d10802ec4c153a6e21eebaf412e2abd29736 , < c55b2b983b0fa012942c3eb16384b2b722caa810 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 4.14.283 , ≤ 4.14.* (semver)
Unaffected: 4.19.247 , ≤ 4.19.* (semver)
Unaffected: 5.4.198 , ≤ 5.4.* (semver)
Unaffected: 5.10.122 , ≤ 5.10.* (semver)
Unaffected: 5.15.47 , ≤ 5.15.* (semver)
Unaffected: 5.17.15 , ≤ 5.17.* (semver)
Unaffected: 5.18.4 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49300",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:44:48.211252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:59.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "165cf2e0019fa6cedc75b456490c41494c34abb4",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "2573f2375b64280be977431701ed5d33b75b9ad0",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "8a7da4ced236ce6637fe70f14ca18e718d4bf9e9",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "122e4adaff2439f1cc18cc7e931980fa7560df5c",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "71c142f910da44421213ade601bcbd23ceae19fa",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "2888fa41985f93ed0a6837cfbb06bcbfd7fa2314",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "d09525720dd5201756f698bee1076de9aefd4602",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            },
            {
              "lessThan": "c55b2b983b0fa012942c3eb16384b2b722caa810",
              "status": "affected",
              "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/nbd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.283",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.283",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.122",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.47",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between nbd_alloc_config() and module removal\n\nWhen nbd module is being removing, nbd_alloc_config() may be\ncalled concurrently by nbd_genl_connect(), although try_module_get()\nwill return false, but nbd_alloc_config() doesn\u0027t handle it.\n\nThe race may lead to the leak of nbd_config and its related\nresources (e.g, recv_workq) and oops in nbd_read_stat() due\nto the unload of nbd module as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  Oops: 0000 [#1] SMP PTI\n  CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  Workqueue: knbd16-recv recv_work [nbd]\n  RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]\n  Call Trace:\n   recv_work+0x3b/0xb0 [nbd]\n   process_one_work+0x1ed/0x390\n   worker_thread+0x4a/0x3d0\n   kthread+0x12a/0x150\n   ret_from_fork+0x22/0x30\n\nFixing it by checking the return value of try_module_get()\nin nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),\nassign nbd-\u003econfig only when nbd_alloc_config() succeeds to ensure\nthe value of nbd-\u003econfig is binary (valid or NULL).\n\nAlso adding a debug message to check the reference counter\nof nbd_config during module removal."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:57:00.337Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/165cf2e0019fa6cedc75b456490c41494c34abb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2573f2375b64280be977431701ed5d33b75b9ad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a7da4ced236ce6637fe70f14ca18e718d4bf9e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/122e4adaff2439f1cc18cc7e931980fa7560df5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/71c142f910da44421213ade601bcbd23ceae19fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/2888fa41985f93ed0a6837cfbb06bcbfd7fa2314"
        },
        {
          "url": "https://git.kernel.org/stable/c/d09525720dd5201756f698bee1076de9aefd4602"
        },
        {
          "url": "https://git.kernel.org/stable/c/c55b2b983b0fa012942c3eb16384b2b722caa810"
        }
      ],
      "title": "nbd: fix race between nbd_alloc_config() and module removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49300",
    "datePublished": "2025-02-26T02:10:35.594Z",
    "dateReserved": "2025-02-26T02:08:31.534Z",
    "dateUpdated": "2026-05-11T18:57:00.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49300",
      "date": "2026-09-26",
      "epss": "0.00191",
      "percentile": "0.0782"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/nbd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "165cf2e0019fa6cedc75b456490c41494c34abb4",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2573f2375b64280be977431701ed5d33b75b9ad0",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a7da4ced236ce6637fe70f14ca18e718d4bf9e9",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "122e4adaff2439f1cc18cc7e931980fa7560df5c",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "71c142f910da44421213ade601bcbd23ceae19fa",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2888fa41985f93ed0a6837cfbb06bcbfd7fa2314",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d09525720dd5201756f698bee1076de9aefd4602",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c55b2b983b0fa012942c3eb16384b2b722caa810",
                    "status": "affected",
                    "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/nbd.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.283",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.247",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.198",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.122",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.47",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "42074657-A7B6-4740-88B7-67B440018C1C",
                    "versionEndExcluding": "4.14.283",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8CFA0F4-2D75-41F4-9753-87944A08B53B",
                    "versionEndExcluding": "4.19.247",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9",
                    "versionEndExcluding": "5.4.198",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1B42AA01-44D8-4572-95E6-FF8E374CF9C5",
                    "versionEndExcluding": "5.10.122",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FC042EE3-4864-4325-BE0B-4BCDBF11AA61",
                    "versionEndExcluding": "5.15.47",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD",
                    "versionEndExcluding": "5.17.15",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6D643C-6D6A-4821-8A8D-B5776B8F0103",
                    "versionEndExcluding": "5.18.4",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between nbd_alloc_config() and module removal\n\nWhen nbd module is being removing, nbd_alloc_config() may be\ncalled concurrently by nbd_genl_connect(), although try_module_get()\nwill return false, but nbd_alloc_config() doesn\u0027t handle it.\n\nThe race may lead to the leak of nbd_config and its related\nresources (e.g, recv_workq) and oops in nbd_read_stat() due\nto the unload of nbd module as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  Oops: 0000 [#1] SMP PTI\n  CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  Workqueue: knbd16-recv recv_work [nbd]\n  RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]\n  Call Trace:\n   recv_work+0x3b/0xb0 [nbd]\n   process_one_work+0x1ed/0x390\n   worker_thread+0x4a/0x3d0\n   kthread+0x12a/0x150\n   ret_from_fork+0x22/0x30\n\nFixing it by checking the return value of try_module_get()\nin nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),\nassign nbd-\u003econfig only when nbd_alloc_config() succeeds to ensure\nthe value of nbd-\u003econfig is binary (valid or NULL).\n\nAlso adding a debug message to check the reference counter\nof nbd_config during module removal."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nbd: se corrige la ejecuci\u00f3n entre nbd_alloc_config() y la eliminaci\u00f3n del m\u00f3dulo Cuando se elimina el m\u00f3dulo nbd, nbd_alloc_config() puede ser llamado simult\u00e1neamente por nbd_genl_connect(), aunque try_module_get() devolver\u00e1 falso, pero nbd_alloc_config() no lo maneja. La ejecuci\u00f3n puede provocar la fuga de nbd_config y sus recursos relacionados (por ejemplo, recv_workq) y oops en nbd_read_stat() debido a la descarga del m\u00f3dulo nbd como se muestra a continuaci\u00f3n: ERROR: desreferencia de puntero NULL del n\u00facleo, direcci\u00f3n: 0000000000000040 Oops: 0000 [#1] SMP PTI CPU: 5 PID: 13840 Comm: kworker/u17:33 No contaminado 5.14.0+ #1 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996) Cola de trabajo: knbd16-recv recv_work [nbd] RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd] Rastreo de llamadas: recv_work+0x3b/0xb0 [nbd] process_one_work+0x1ed/0x390 worker_thread+0x4a/0x3d0 kthread+0x12a/0x150 ret_from_fork+0x22/0x30 Lo solucionamos comprobando el valor de retorno de try_module_get() en nbd_alloc_config(). Como nbd_alloc_config() puede devolver ERR_PTR(-ENODEV), asigne nbd-\u0026gt;config solo cuando nbd_alloc_config() tenga \u00e9xito para garantizar que el valor de nbd-\u0026gt;config sea binario (v\u00e1lido o NULL). Tambi\u00e9n se agreg\u00f3 un mensaje de depuraci\u00f3n para comprobar el contador de referencia de nbd_config durante la eliminaci\u00f3n del m\u00f3dulo."
          }
        ],
        "id": "CVE-2022-49300",
        "lastModified": "2026-06-17T05:17:38.703",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49300",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:44:48.211252Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:06.830",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/122e4adaff2439f1cc18cc7e931980fa7560df5c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/165cf2e0019fa6cedc75b456490c41494c34abb4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2573f2375b64280be977431701ed5d33b75b9ad0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2888fa41985f93ed0a6837cfbb06bcbfd7fa2314"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/71c142f910da44421213ade601bcbd23ceae19fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8a7da4ced236ce6637fe70f14ca18e718d4bf9e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c55b2b983b0fa012942c3eb16384b2b722caa810"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d09525720dd5201756f698bee1076de9aefd4602"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              },
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:04:18+00:00",
      "cve": "CVE-2022-49300",
      "id": "CVE-2022-49300",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "62",
      "product_status:known_not_affected": "212",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nbd: fix race between nbd_alloc_config() and module removal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49300.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:05:03Z",
      "cve": "CVE-2022-49300",
      "id": "CVE-2022-49300",
      "initial_release_date": "2025-02-27T03:09:11Z",
      "product_status:known_affected": "453",
      "product_status:known_not_affected": "200",
      "product_status:recommended": "319",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49300",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49300.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 4.7,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49300",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:44:48.211252Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-476",
                    "description": "CWE-476 NULL Pointer Dereference",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:13:24.727Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/block/nbd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "165cf2e0019fa6cedc75b456490c41494c34abb4",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "2573f2375b64280be977431701ed5d33b75b9ad0",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "8a7da4ced236ce6637fe70f14ca18e718d4bf9e9",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "122e4adaff2439f1cc18cc7e931980fa7560df5c",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "71c142f910da44421213ade601bcbd23ceae19fa",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "2888fa41985f93ed0a6837cfbb06bcbfd7fa2314",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "d09525720dd5201756f698bee1076de9aefd4602",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                },
                {
                  "lessThan": "c55b2b983b0fa012942c3eb16384b2b722caa810",
                  "status": "affected",
                  "version": "5ea8d10802ec4c153a6e21eebaf412e2abd29736",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/block/nbd.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.12"
                },
                {
                  "lessThan": "4.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.283",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.247",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.198",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.122",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.47",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.15",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.283",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.247",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.198",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.122",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.47",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.15",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.4",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19",
                      "versionStartIncluding": "4.12",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between nbd_alloc_config() and module removal\n\nWhen nbd module is being removing, nbd_alloc_config() may be\ncalled concurrently by nbd_genl_connect(), although try_module_get()\nwill return false, but nbd_alloc_config() doesn\u0027t handle it.\n\nThe race may lead to the leak of nbd_config and its related\nresources (e.g, recv_workq) and oops in nbd_read_stat() due\nto the unload of nbd module as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  Oops: 0000 [#1] SMP PTI\n  CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  Workqueue: knbd16-recv recv_work [nbd]\n  RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]\n  Call Trace:\n   recv_work+0x3b/0xb0 [nbd]\n   process_one_work+0x1ed/0x390\n   worker_thread+0x4a/0x3d0\n   kthread+0x12a/0x150\n   ret_from_fork+0x22/0x30\n\nFixing it by checking the return value of try_module_get()\nin nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),\nassign nbd-\u003econfig only when nbd_alloc_config() succeeds to ensure\nthe value of nbd-\u003econfig is binary (valid or NULL).\n\nAlso adding a debug message to check the reference counter\nof nbd_config during module removal."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T18:57:00.337Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/165cf2e0019fa6cedc75b456490c41494c34abb4"
            },
            {
              "url": "https://git.kernel.org/stable/c/2573f2375b64280be977431701ed5d33b75b9ad0"
            },
            {
              "url": "https://git.kernel.org/stable/c/8a7da4ced236ce6637fe70f14ca18e718d4bf9e9"
            },
            {
              "url": "https://git.kernel.org/stable/c/122e4adaff2439f1cc18cc7e931980fa7560df5c"
            },
            {
              "url": "https://git.kernel.org/stable/c/71c142f910da44421213ade601bcbd23ceae19fa"
            },
            {
              "url": "https://git.kernel.org/stable/c/2888fa41985f93ed0a6837cfbb06bcbfd7fa2314"
            },
            {
              "url": "https://git.kernel.org/stable/c/d09525720dd5201756f698bee1076de9aefd4602"
            },
            {
              "url": "https://git.kernel.org/stable/c/c55b2b983b0fa012942c3eb16384b2b722caa810"
            }
          ],
          "title": "nbd: fix race between nbd_alloc_config() and module removal",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49300",
        "datePublished": "2025-02-26T02:10:35.594Z",
        "dateReserved": "2025-02-26T02:08:31.534Z",
        "dateUpdated": "2026-05-11T18:57:00.337Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.