CVE-2022-48686

nvme-tcp: fix UAF when detecting digest errors

State: Published
Severity: 9.8 Critical
Published: May 3, 2024
Updated: Aug 5, 2026
Reserved: May 3, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix UAF when detecting digest errors

We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 19816a0214684f70b49b25075ff8c402fdd611d3Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 5914fa32ef1b7766fea933f9eed94ac5c00aa7ffAffected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 13c80a6c112467bab5e44d090767930555fc17a5Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before c3eb461aa56e6fa94fb80442ba2586bd223a8886Affected 3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 160f3549a907a50e51a8518678ba2dcf2541abeaAffected
LinuxLinux	5.0Affected before 5.0Not affected 5.4.213 through 5.4.Not affected 5.10.143 through 5.10.Not affected 5.15.68 through 5.15.Not affected 5.19.9 through 5.19.Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 19816a0214684f70b49b25075ff8c402fdd611d3Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 5914fa32ef1b7766fea933f9eed94ac5c00aa7ffAffected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 13c80a6c112467bab5e44d090767930555fc17a5Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before c3eb461aa56e6fa94fb80442ba2586bd223a8886Affected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to before 160f3549a907a50e51a8518678ba2dcf2541abeaAffected

LinuxLinux

5.0Affected
before 5.0Not affected
5.4.213 through 5.4.*Not affected
5.10.143 through 5.10.*Not affected
5.15.68 through 5.15.*Not affected
5.19.9 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.