CVE-2022-49390: macsec: fix UAF bug for real_dev

Q: What is the severity of CVE-2022-49390?

CVE-2022-49390 is classified as a high severity vulnerability due to the potential for use-after-free issues in the Linux kernel.

Q: How do I fix CVE-2022-49390?

To fix CVE-2022-49390, update your Linux kernel to the latest stable version that resolves this vulnerability.

Q: What systems are affected by CVE-2022-49390?

CVE-2022-49390 affects multiple versions of the Linux kernel, specifically those between 4.14.154 and 5.18.3.

Q: What is the cause of CVE-2022-49390?

CVE-2022-49390 is caused by a use-after-free issue related to the macsec device not properly managing the reference to the underlying real_dev.

Q: Has CVE-2022-49390 been patched?

Yes, CVE-2022-49390 has been resolved in recent kernel updates, so users should apply the patches as soon as possible.

Published Feb 26, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix UAF bug for realdev

Create a new macsec device but not get reference to realdev. That can not ensure that realdev is freed after macsec. That will trigger the UAF bug for realdev as following:

================================================================== BUG: KASAN: use-after-free in macsecgetiflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsecgetiflink+0x5f/0x70 drivers/net/macsec.c:3662 devgetiflink+0x73/0xe0 net/core/dev.c:637 defaultoperstate net/core/linkwatch.c:42 [inline] rfc2863policy+0x233/0x2d0 net/core/linkwatch.c:54 linkwatchdodev+0x2a/0x150 net/core/linkwatch.c:161

Allocated by task 22209: ... allocnetdevmqs+0x98/0x1100 net/core/dev.c:10549 rtnlcreatelink+0x9d7/0xc00 net/core/rtnetlink.c:3235 vethnewlink+0x20e/0xa90 drivers/net/veth.c:1748

Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 devicerelease+0x9f/0x240 drivers/base/core.c:2229 kobjectcleanup lib/kobject.c:673 [inline] kobjectrelease lib/kobject.c:704 [inline] krefput include/linux/kref.h:65 [inline] kobjectput+0x1c8/0x540 lib/kobject.c:721 netdevruntodo+0x72e/0x10b0 net/core/dev.c:10327

After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackholenetdev"), we can add devholdtrack() in macsecdevinit() and devputtrack() in macsecfreenetdev() to fix the problem.

Affected Software

169 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=4.14.154<4.15

Linux Linux kernel>=4.19.84<4.20

Linux Linux kernel>=5.3.11<5.17.15

Linux Linux kernel>=5.18<5.18.3

debian/linux<5.18.5-1

5.18.5-1

debian/linux<5.18.5-1

5.18.5-1

debian/linux<5.18.5-1

5.18.5-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux-azure<4.15.0-1195.210~14.04.1

4.15.0-1195.210~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1187.200~16.04.1

4.15.0-1187.200~16.04.1

ubuntu/linux-azure<4.15.0-1195.210~16.04.1

4.15.0-1195.210~16.04.1

ubuntu/linux-gcp<4.15.0-1180.197~16.04.1

4.15.0-1180.197~16.04.1

ubuntu/linux-hwe<4.15.0-245.257~16.04.1

4.15.0-245.257~16.04.1

ubuntu/linux-oracle<4.15.0-1149.160~16.04.1

4.15.0-1149.160~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux<4.15.0-245.257

4.15.0-245.257

ubuntu/linux-aws<4.15.0-1187.200

4.15.0-1187.200

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1153.163~18.04.1

5.4.0-1153.163~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1195.210

4.15.0-1195.210

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1156.163~18.04.1

5.4.0-1156.163~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1180.197

4.15.0-1180.197

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1156.165~18.04.1

5.4.0-1156.165~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-224.244~18.04.1

5.4.0-224.244~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1099.104~18.04.1

5.4.0-1099.104~18.04.1

ubuntu/linux-kvm<4.15.0-1169.174

4.15.0-1169.174

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1149.160

4.15.0-1149.160

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1151.161~18.04.1

5.4.0-1151.161~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1136.149~18.04.1

5.4.0-1136.149~18.04.1

ubuntu/linux-aws-fips<4.15.0-2125.131

4.15.0-2125.131

ubuntu/linux-azure-fips<4.15.0-2104.110

4.15.0-2104.110

ubuntu/linux-fips<4.15.0-1142.154

4.15.0-1142.154

ubuntu/linux-gcp-fips<4.15.0-2088.94

4.15.0-2088.94

ubuntu/linux-fips*

ubuntu/linux<5.4.0-224.244

5.4.0-224.244

ubuntu/linux-aws<5.4.0-1153.163

5.4.0-1153.163

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1098.105~20.04.1

5.15.0-1098.105~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1156.163

5.4.0-1156.163

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1102.111~20.04.1

5.15.0-1102.111~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield<5.4.0-1112.119

5.4.0-1112.119

ubuntu/linux-gcp<5.4.0-1156.165

5.4.0-1156.165

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1098.107~20.04.1

5.15.0-1098.107~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-164.174~20.04.1

5.15.0-164.174~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1099.104

5.4.0-1099.104

ubuntu/linux-ibm-5.15<5.15.0-1092.95~20.04.1

5.15.0-1092.95~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1093.99~20.04.1

5.15.0-1093.99~20.04.1

ubuntu/linux-iot<5.4.0-1057.60

5.4.0-1057.60

ubuntu/linux-kvm<5.4.0-1140.149

5.4.0-1140.149

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-164.174~20.04.1

5.15.0-164.174~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1050.50~20.04.1

5.15.0-1050.50~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1151.161

5.4.0-1151.161

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1095.101~20.04.1

5.15.0-1095.101~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1136.149

5.4.0-1136.149

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1093.97~20.04.2

5.15.0-1093.97~20.04.2

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1071.75

5.4.0-1071.75

ubuntu/linux-aws-fips<5.4.0-1153.163+fips1

5.4.0-1153.163+fips1

ubuntu/linux-azure-fips<5.4.0-1157.164+fips1

5.4.0-1157.164+fips1

ubuntu/linux-fips<5.4.0-1127.137

5.4.0-1127.137

ubuntu/linux-gcp-fips<5.4.0-1156.165+fips1

5.4.0-1156.165+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-164.174

5.15.0-164.174

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1098.105

5.15.0-1098.105

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1102.111

5.15.0-1102.111

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde<5.15.0-1102.111.1

5.15.0-1102.111.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1098.107

5.15.0-1098.107

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1094.100

5.15.0-1094.100

ubuntu/linux-gkeop<5.15.0-1081.89

5.15.0-1081.89

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1092.95

5.15.0-1092.95

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1093.99

5.15.0-1093.99

ubuntu/linux-kvm<5.15.0-1090.95

5.15.0-1090.95

ubuntu/linux-lowlatency<5.15.0-164.174

5.15.0-164.174

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia<5.15.0-1093.94

5.15.0-1093.94

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-tegra<5.15.0-1050.50

5.15.0-1050.50

ubuntu/linux-nvidia-tegra-igx<5.15.0-1039.39

5.15.0-1039.39

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1095.101

5.15.0-1095.101

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1092.95

5.15.0-1092.95

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1062.66

5.15.0-1062.66

ubuntu/linux-bluefield<5.15.0-1082.84

5.15.0-1082.84

ubuntu/linux-intel-iot-realtime<5.15.0-1090.92

5.15.0-1090.92

ubuntu/linux-realtime<5.15.0-1097.106

5.15.0-1097.106

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1098.105+fips1

5.15.0-1098.105+fips1

ubuntu/linux-azure-fips<5.15.0-1102.111+fips1

5.15.0-1102.111+fips1

ubuntu/linux-fips<5.15.0-164.174+fips1

5.15.0-164.174+fips1

ubuntu/linux-gcp-fips<5.15.0-1098.107+fips1

5.15.0-1098.107+fips1

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.18.5-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1195.210~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1187.200~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1195.210~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1180.197~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-245.257~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1149.160~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-245.257
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1187.200
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1153.163~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1195.210
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.163~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1180.197
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.165~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-224.244~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1099.104~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1169.174
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1149.160
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1151.161~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1136.149~18.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2125.131
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2104.110
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1142.154
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2088.94
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-224.244
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1153.163
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1098.105~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.163
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1112.119
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.165
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1098.107~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-164.174~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1099.104
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.95~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.99~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1057.60
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1140.149
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-164.174~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1050.50~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1151.161
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.101~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1136.149
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.97~20.04.2
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1071.75
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1153.163+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1157.164+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1127.137
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1156.165+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-164.174
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1098.105
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1098.107
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.100
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1081.89
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.95
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.99
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.95
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-164.174
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1093.94
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1050.50
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1039.39
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.101
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1092.95
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1062.66
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.84
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1090.92
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.106
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1098.105+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1102.111+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-164.174+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1098.107+fips1
Compensating control
In the Linux kernel macsec driver, add dev_hold_track() in macsec_dev_init() to hold a reference to real_dev, and add dev_put_track() in macsec_free_netdev() to release it.

Event History

Feb 26, 2025

CVE Published

via MITRE·02:11 AM

Data Sourced

via MITRE·02:11 AM

DescriptionSeverity

Data Sourced

via OSV·07:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-49390?

CVE-2022-49390 is classified as a high severity vulnerability due to the potential for use-after-free issues in the Linux kernel.

How do I fix CVE-2022-49390?

To fix CVE-2022-49390, update your Linux kernel to the latest stable version that resolves this vulnerability.

What systems are affected by CVE-2022-49390?

CVE-2022-49390 affects multiple versions of the Linux kernel, specifically those between 4.14.154 and 5.18.3.

What is the cause of CVE-2022-49390?

CVE-2022-49390 is caused by a use-after-free issue related to the macsec device not properly managing the reference to the underlying real_dev.

Has CVE-2022-49390 been patched?

Yes, CVE-2022-49390 has been resolved in recent kernel updates, so users should apply the patches as soon as possible.

CVE-2022-49390: macsec: fix UAF bug for real_dev

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2022-49390?

How do I fix CVE-2022-49390?

What systems are affected by CVE-2022-49390?

What is the cause of CVE-2022-49390?

Has CVE-2022-49390 been patched?

Company

Resources

Contact