CVE-2022-48697

nvmet: fix a use-after-free

State: Published
Severity: 9.8 Critical
Published: May 3, 2024
Updated: Aug 5, 2026
Reserved: May 3, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix a use-after-free

Fix the following use-after-free complaint triggered by blktests nvme/004:

BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a07b4970f464f13640e28e16dad6cfa33647cc99 to before 17f121ca3ec6be0fb32d77c7f65362934a38cc8eAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before be01f1c988757b95f11f090a9f491365670a522bAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before ebf46da50beb78066674354ad650606a467e33faAffected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 4484ce97a78171668c402e0c45db7f760aea8060Affected a07b4970f464f13640e28e16dad6cfa33647cc99 to before 6a02a61e81c231cc5c680c5dbf8665275147ac52Affected
LinuxLinux	4.8Affected before 4.8Not affected 4.19.260 through 4.19.Not affected 5.4.213 through 5.4.Not affected 5.10.143 through 5.10.Not affected 5.15.68 through 5.15.Not affected 5.19.9 through 5.19.*Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

a07b4970f464f13640e28e16dad6cfa33647cc99 to before 17f121ca3ec6be0fb32d77c7f65362934a38cc8eAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 8d66989b5f7bb28bba2f8e1e2ffc8bfef4a10717Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before be01f1c988757b95f11f090a9f491365670a522bAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before ebf46da50beb78066674354ad650606a467e33faAffected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 4484ce97a78171668c402e0c45db7f760aea8060Affected
a07b4970f464f13640e28e16dad6cfa33647cc99 to before 6a02a61e81c231cc5c680c5dbf8665275147ac52Affected

LinuxLinux

4.8Affected
before 4.8Not affected
4.19.260 through 4.19.*Not affected
5.4.213 through 5.4.*Not affected
5.10.143 through 5.10.*Not affected
5.15.68 through 5.15.*Not affected
5.19.9 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.