CVE-2022-49492

nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags

In nvme_alloc_admin_tags, the admin_q can be set to an error (typically -ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the stack, to nvme_reset_work the error takes us to nvme_remove_dead_ctrl() nvme_dev_disable() nvme_suspend_queue(&dev->queues[0]).

Here, we only check that the admin_q is non-NULL, rather than not an error or NULL, and begin quiescing a queue that never existed, leading to bad / NULL pointer dereference.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 8321b17789f614414206af07e17ce4751c95dc76Affected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 9e649471b396fa0139d53919354ce1eace9b9a24Affected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 8da2b7bdb47e94bbc4062a3978c708926bcb022cAffected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before f76729662650cd7bc8f8194e057af381370349a7Affected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before af98940dd33c9f9e1beb4f71c0a39260100e2a65Affected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 906c81dba8ee8057523859b5e1a2479e9fd34860Affected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 7a28556082d1fbcbc599baf1c24252dfc73efefcAffected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 54a4c1e47d1b2585e74920399455bd9abbfb2bd7Affected 35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before da42761181627e9bdc37d18368b827948a583929Affected
LinuxLinux	3.19Affected before 3.19Not affected 4.9.318 through 4.9.Not affected 4.14.283 through 4.14.Not affected 4.19.247 through 4.19.Not affected 5.4.198 through 5.4.Not affected 5.10.121 through 5.10.Not affected 5.15.46 through 5.15.Not affected 5.17.14 through 5.17.Not affected 5.18.3 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 8321b17789f614414206af07e17ce4751c95dc76Affected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 9e649471b396fa0139d53919354ce1eace9b9a24Affected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 8da2b7bdb47e94bbc4062a3978c708926bcb022cAffected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before f76729662650cd7bc8f8194e057af381370349a7Affected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before af98940dd33c9f9e1beb4f71c0a39260100e2a65Affected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 906c81dba8ee8057523859b5e1a2479e9fd34860Affected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 7a28556082d1fbcbc599baf1c24252dfc73efefcAffected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before 54a4c1e47d1b2585e74920399455bd9abbfb2bd7Affected
35b489d32fcc37e8735f41aa794b24cf9d1e74f5 to before da42761181627e9bdc37d18368b827948a583929Affected

LinuxLinux

3.19Affected
before 3.19Not affected
4.9.318 through 4.9.*Not affected
4.14.283 through 4.14.*Not affected
4.19.247 through 4.19.*Not affected
5.4.198 through 5.4.*Not affected
5.10.121 through 5.10.*Not affected
5.15.46 through 5.15.*Not affected
5.17.14 through 5.17.*Not affected
5.18.3 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.