CVE-2022-49084

qede: confirm skb is allocated before using

State: Published
Severity: 7.5 High
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

qede: confirm skb is allocated before using

qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL.

Add a check in case build_skb() failed to allocate and return NULL.

The NULL return is handled correctly in callers to qede_build_skb().

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8a8633978b842c88fbcfe00d4e5dde96048f630e to before 9648adb1b3ece55c657d3a4f52bfee663b710dfeAffected 8a8633978b842c88fbcfe00d4e5dde96048f630e to before 034a92c6a81048128fc7b18d278d52438a13902aAffected 8a8633978b842c88fbcfe00d4e5dde96048f630e to before 8928239e5e2e460d95b8a0b89f61671625e7ece0Affected 8a8633978b842c88fbcfe00d4e5dde96048f630e to before c9bdce2359b5f4986eb38d1e81865b3586cc20d2Affected 8a8633978b842c88fbcfe00d4e5dde96048f630e to before b2d6b3db9d1cf80908964036dbe1c52a86b1afb1Affected 8a8633978b842c88fbcfe00d4e5dde96048f630e to before e1fd0c42acfa22bb34d2ab6a111484f466ab8093Affected 8a8633978b842c88fbcfe00d4e5dde96048f630e to before 4e910dbe36508654a896d5735b318c0b88172570Affected
LinuxLinux	4.18Affected before 4.18Not affected 4.19.238 through 4.19.Not affected 5.4.189 through 5.4.Not affected 5.10.111 through 5.10.Not affected 5.15.34 through 5.15.Not affected 5.16.20 through 5.16.Not affected 5.17.3 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

8a8633978b842c88fbcfe00d4e5dde96048f630e to before 9648adb1b3ece55c657d3a4f52bfee663b710dfeAffected
8a8633978b842c88fbcfe00d4e5dde96048f630e to before 034a92c6a81048128fc7b18d278d52438a13902aAffected
8a8633978b842c88fbcfe00d4e5dde96048f630e to before 8928239e5e2e460d95b8a0b89f61671625e7ece0Affected
8a8633978b842c88fbcfe00d4e5dde96048f630e to before c9bdce2359b5f4986eb38d1e81865b3586cc20d2Affected
8a8633978b842c88fbcfe00d4e5dde96048f630e to before b2d6b3db9d1cf80908964036dbe1c52a86b1afb1Affected
8a8633978b842c88fbcfe00d4e5dde96048f630e to before e1fd0c42acfa22bb34d2ab6a111484f466ab8093Affected
8a8633978b842c88fbcfe00d4e5dde96048f630e to before 4e910dbe36508654a896d5735b318c0b88172570Affected

LinuxLinux

4.18Affected
before 4.18Not affected
4.19.238 through 4.19.*Not affected
5.4.189 through 5.4.*Not affected
5.10.111 through 5.10.*Not affected
5.15.34 through 5.15.*Not affected
5.16.20 through 5.16.*Not affected
5.17.3 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.