CVE-2022-49026: e100: Fix possible use after free in e100_xmit_prepare
First published: Mon Oct 21 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the skb. But the skb is already freed, which will cause UAF bug when the upper layer resends the skb. Remove the harmful free.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=4.3<5.10.158 | |
| Linux Kernel | >=5.11<5.15.82 | |
| Linux Kernel | >=5.16<6.0.12 | |
| Linux Kernel | =6.1-rc1 | |
| Linux Kernel | =6.1-rc2 | |
| Linux Kernel | =6.1-rc3 | |
| Linux Kernel | =6.1-rc4 | |
| Linux Kernel | =6.1-rc5 | |
| Linux Kernel | =6.1-rc6 | |
| Linux Kernel | =6.1-rc7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-49026?
CVE-2022-49026 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2022-49026?
To fix CVE-2022-49026, ensure that your Linux kernel is updated to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-49026?
CVE-2022-49026 affects multiple versions of the Linux kernel, including versions from 4.3 to 6.0.12 and certain release candidate versions.
What is the nature of the vulnerability in CVE-2022-49026?
The vulnerability in CVE-2022-49026 is a use after free issue that occurs within the e100 networking driver.
What are the potential consequences of CVE-2022-49026?
Exploitation of CVE-2022-49026 could lead to instability or a denial of service in affected systems running the vulnerable versions of the Linux kernel.
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel
- version/linux kernel/4.3
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/6.1-rc1
- version/linux kernel/6.1-rc2
- version/linux kernel/6.1-rc3
- version/linux kernel/6.1-rc4
- version/linux kernel/6.1-rc5
- version/linux kernel/6.1-rc6
- version/linux kernel/6.1-rc7