Riskcovery

CVE-2022-48637

bnxt: prevent skb UAF after handing over to PTP worker

State
Published
Severity
7.8 High
Published
Apr 28, 2024
Updated
Aug 5, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bnxt: prevent skb UAF after handing over to PTP worker

When reading the timestamp is required bnxt_tx_int() hands over the ownership of the completed skb to the PTP worker. The skb should not be used afterwards, as the worker may run before the rest of our code and free the skb, leading to a use-after-free.

Since dev_kfree_skb_any() accepts NULL make the loss of ownership more obvious and set skb to NULL.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 83bb623c968e7351aee5111547693f95f330dc5a to before 08483e4c0c83b221b8891434a04cec405dee94a6Affected
  • 83bb623c968e7351aee5111547693f95f330dc5a to before 32afa1f23e42cc635ccf4c39f24514d03d1e8338Affected
  • 83bb623c968e7351aee5111547693f95f330dc5a to before c31f26c8f69f776759cbbdfb38e40ea91aa0dd65Affected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 5.15.71 through 5.15.*Not affected
  • 5.19.12 through 5.19.*Not affected
  • 6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.