CVE-2022-49215 (GCVE-0-2022-49215)
Vulnerability from cvelistv5
Published
2025-02-26 01:55
Modified
2026-08-05 08:54
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race at socket teardown Fix a race in the xsk socket teardown code that can lead to a NULL pointer dereference splat. The current xsk unbind code in xsk_unbind_dev() starts by setting xs->state to XSK_UNBOUND, sets xs->dev to NULL and then waits for any NAPI processing to terminate using synchronize_net(). After that, the release code starts to tear down the socket state and free allocated memory. BUG: kernel NULL pointer dereference, address: 00000000000000c0 PGD 8000000932469067 P4D 8000000932469067 PUD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 25 PID: 69132 Comm: grpcpp_sync_ser Tainted: G I 5.16.0+ #2 Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.2.10 03/09/2015 RIP: 0010:__xsk_sendmsg+0x2c/0x690 [...] RSP: 0018:ffffa2348bd13d50 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff8d5fc632d258 RDX: 0000000000400000 RSI: ffffa2348bd13e10 RDI: ffff8d5fc5489800 RBP: ffffa2348bd13db0 R08: 0000000000000000 R09: 00007ffffffff000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d5fc5489800 R13: ffff8d5fcb0f5140 R14: ffff8d5fcb0f5140 R15: 0000000000000000 FS: 00007f991cff9400(0000) GS:ffff8d6f1f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000c0 CR3: 0000000114888005 CR4: 00000000001706e0 Call Trace: <TASK> ? aa_sk_perm+0x43/0x1b0 xsk_sendmsg+0xf0/0x110 sock_sendmsg+0x65/0x70 __sys_sendto+0x113/0x190 ? debug_smp_processor_id+0x17/0x20 ? fpregs_assert_state_consistent+0x23/0x50 ? exit_to_user_mode_prepare+0xa5/0x1d0 __x64_sys_sendto+0x29/0x30 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae There are two problems with the current code. First, setting xs->dev to NULL before waiting for all users to stop using the socket is not correct. The entry to the data plane functions xsk_poll(), xsk_sendmsg(), and xsk_recvmsg() are all guarded by a test that xs->state is in the state XSK_BOUND and if not, it returns right away. But one process might have passed this test but still have not gotten to the point in which it uses xs->dev in the code. In this interim, a second process executing xsk_unbind_dev() might have set xs->dev to NULL which will lead to a crash for the first process. The solution here is just to get rid of this NULL assignment since it is not used anymore. Before commit 42fddcc7c64b ("xsk: use state member for socket synchronization"), xs->dev was the gatekeeper to admit processes into the data plane functions, but it was replaced with the state variable xs->state in the aforementioned commit. The second problem is that synchronize_net() does not wait for any process in xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() to complete, which means that the state they rely on might be cleaned up prematurely. This can happen when the notifier gets called (at driver unload for example) as it uses xsk_unbind_dev(). Solve this by extending the RCU critical region from just the ndo_xsk_wakeup to the whole functions mentioned above, so that both the test of xs->state == XSK_BOUND and the last use of any member of xs is covered by the RCU critical section. This will guarantee that when synchronize_net() completes, there will be no processes left executing xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() and state can be cleaned up safely. Note that we need to drop the RCU lock for the skb xmit path as it uses functions that might sleep. Due to this, we have to retest the xs->state after we grab the mutex that protects the skb xmit code from, among a number of things, an xsk_unbind_dev() being executed from the notifier at the same time.
References
Impacted products
Vendor Product Version
Linux Linux Version: 42fddcc7c64b723a867c7b2f5f7505e244212f13
Version: 42fddcc7c64b723a867c7b2f5f7505e244212f13
Version: 42fddcc7c64b723a867c7b2f5f7505e244212f13
Version: 42fddcc7c64b723a867c7b2f5f7505e244212f13
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:46:39.445986Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:47:05.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad7219cd8751bd258b9d1e69ae0654ec00f71875",
              "status": "affected",
              "version": "42fddcc7c64b723a867c7b2f5f7505e244212f13",
              "versionType": "git"
            },
            {
              "lessThan": "d1579253ffce39986e7a6ab757ac93b2680a665f",
              "status": "affected",
              "version": "42fddcc7c64b723a867c7b2f5f7505e244212f13",
              "versionType": "git"
            },
            {
              "lessThan": "8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9",
              "status": "affected",
              "version": "42fddcc7c64b723a867c7b2f5f7505e244212f13",
              "versionType": "git"
            },
            {
              "lessThan": "18b1ab7aa76bde181bdb1ab19a87fa9523c32f21",
              "status": "affected",
              "version": "42fddcc7c64b723a867c7b2f5f7505e244212f13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix race at socket teardown\n\nFix a race in the xsk socket teardown code that can lead to a NULL pointer\ndereference splat. The current xsk unbind code in xsk_unbind_dev() starts by\nsetting xs-\u003estate to XSK_UNBOUND, sets xs-\u003edev to NULL and then waits for any\nNAPI processing to terminate using synchronize_net(). After that, the release\ncode starts to tear down the socket state and free allocated memory.\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000c0\n  PGD 8000000932469067 P4D 8000000932469067 PUD 0\n  Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 25 PID: 69132 Comm: grpcpp_sync_ser Tainted: G          I       5.16.0+ #2\n  Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.2.10 03/09/2015\n  RIP: 0010:__xsk_sendmsg+0x2c/0x690\n  [...]\n  RSP: 0018:ffffa2348bd13d50 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff8d5fc632d258\n  RDX: 0000000000400000 RSI: ffffa2348bd13e10 RDI: ffff8d5fc5489800\n  RBP: ffffa2348bd13db0 R08: 0000000000000000 R09: 00007ffffffff000\n  R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d5fc5489800\n  R13: ffff8d5fcb0f5140 R14: ffff8d5fcb0f5140 R15: 0000000000000000\n  FS:  00007f991cff9400(0000) GS:ffff8d6f1f700000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000000000c0 CR3: 0000000114888005 CR4: 00000000001706e0\n  Call Trace:\n  \u003cTASK\u003e\n  ? aa_sk_perm+0x43/0x1b0\n  xsk_sendmsg+0xf0/0x110\n  sock_sendmsg+0x65/0x70\n  __sys_sendto+0x113/0x190\n  ? debug_smp_processor_id+0x17/0x20\n  ? fpregs_assert_state_consistent+0x23/0x50\n  ? exit_to_user_mode_prepare+0xa5/0x1d0\n  __x64_sys_sendto+0x29/0x30\n  do_syscall_64+0x3b/0xc0\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThere are two problems with the current code. First, setting xs-\u003edev to NULL\nbefore waiting for all users to stop using the socket is not correct. The\nentry to the data plane functions xsk_poll(), xsk_sendmsg(), and xsk_recvmsg()\nare all guarded by a test that xs-\u003estate is in the state XSK_BOUND and if not,\nit returns right away. But one process might have passed this test but still\nhave not gotten to the point in which it uses xs-\u003edev in the code. In this\ninterim, a second process executing xsk_unbind_dev() might have set xs-\u003edev to\nNULL which will lead to a crash for the first process. The solution here is\njust to get rid of this NULL assignment since it is not used anymore. Before\ncommit 42fddcc7c64b (\"xsk: use state member for socket synchronization\"),\nxs-\u003edev was the gatekeeper to admit processes into the data plane functions,\nbut it was replaced with the state variable xs-\u003estate in the aforementioned\ncommit.\n\nThe second problem is that synchronize_net() does not wait for any process in\nxsk_poll(), xsk_sendmsg(), or xsk_recvmsg() to complete, which means that the\nstate they rely on might be cleaned up prematurely. This can happen when the\nnotifier gets called (at driver unload for example) as it uses xsk_unbind_dev().\nSolve this by extending the RCU critical region from just the ndo_xsk_wakeup\nto the whole functions mentioned above, so that both the test of xs-\u003estate ==\nXSK_BOUND and the last use of any member of xs is covered by the RCU critical\nsection. This will guarantee that when synchronize_net() completes, there will\nbe no processes left executing xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() and\nstate can be cleaned up safely. Note that we need to drop the RCU lock for the\nskb xmit path as it uses functions that might sleep. Due to this, we have to\nretest the xs-\u003estate after we grab the mutex that protects the skb xmit code\nfrom, among a number of things, an xsk_unbind_dev() being executed from the\nnotifier at the same time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local AF_XDP socket operations (sendmsg/recvmsg/poll) racing with xsk_unbind_dev via NETDEV_UNREGISTER or socket teardown; it is not triggered by processing remote network packets alone.\nAC:L - An attacker who can create and bind an AF_XDP socket fully controls both sides of the race\u2014hammering sendmsg/poll on one thread while deleting or unregistering the bound netdev (or otherwise driving unbind) on another\u2014so success does not depend on conditions outside attacker control.\nPR:L - AF_XDP creation only requires ns_capable(net-\u003euser_ns, CAP_NET_RAW) in xsk_create(), which an unprivileged user can obtain in a user/network namespace; device teardown for the race similarly needs only namespaced CAP_NET_ADMIN, not real init-namespace root.\nUI:N - The attacker performs socket setup, I/O, and netdev unregister entirely from their own processes; no separate victim action is required.\nS:U - Impact is confined to the host kernel\u2019s AF_XDP/netdev state under the same OS security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - synchronize_net() does not wait for sendmsg/recvmsg/poll, so socket/device state can be torn down while those paths still run; xsk_wakeup also snapshots xs-\u003edev outside RCU, yielding a use-after-free of net_device/related state that can be leveraged for disclosure.\nI:H - The same UAF/lifetime race on netdev and AF_XDP structures after premature unbind cleanup enables heap reuse and corruption primitives exploitable for integrity violation and control-flow hijacking.\nA:H - The documented failure is a kernel NULL pointer dereference oops in __xsk_sendmsg, and the UAF paths can likewise oops/panic, fully disrupting availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:24.178Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad7219cd8751bd258b9d1e69ae0654ec00f71875"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1579253ffce39986e7a6ab757ac93b2680a665f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/18b1ab7aa76bde181bdb1ab19a87fa9523c32f21"
        }
      ],
      "title": "xsk: Fix race at socket teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49215",
    "datePublished": "2025-02-26T01:55:50.154Z",
    "dateReserved": "2025-02-26T01:49:39.292Z",
    "dateUpdated": "2026-08-05T08:54:24.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49215\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:46:39.445986Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:09:52.462Z\"}}], \"cna\": {\"title\": \"xsk: Fix race at socket teardown\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through local AF_XDP socket operations (sendmsg/recvmsg/poll) racing with xsk_unbind_dev via NETDEV_UNREGISTER or socket teardown; it is not triggered by processing remote network packets alone.\\nAC:L - An attacker who can create and bind an AF_XDP socket fully controls both sides of the race\\u2014hammering sendmsg/poll on one thread while deleting or unregistering the bound netdev (or otherwise driving unbind) on another\\u2014so success does not depend on conditions outside attacker control.\\nPR:L - AF_XDP creation only requires ns_capable(net-\u003euser_ns, CAP_NET_RAW) in xsk_create(), which an unprivileged user can obtain in a user/network namespace; device teardown for the race similarly needs only namespaced CAP_NET_ADMIN, not real init-namespace root.\\nUI:N - The attacker performs socket setup, I/O, and netdev unregister entirely from their own processes; no separate victim action is required.\\nS:U - Impact is confined to the host kernel\\u2019s AF_XDP/netdev state under the same OS security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\\nC:H - synchronize_net() does not wait for sendmsg/recvmsg/poll, so socket/device state can be torn down while those paths still run; xsk_wakeup also snapshots xs-\u003edev outside RCU, yielding a use-after-free of net_device/related state that can be leveraged for disclosure.\\nI:H - The same UAF/lifetime race on netdev and AF_XDP structures after premature unbind cleanup enables heap reuse and corruption primitives exploitable for integrity violation and control-flow hijacking.\\nA:H - The documented failure is a kernel NULL pointer dereference oops in __xsk_sendmsg, and the UAF paths can likewise oops/panic, fully disrupting availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"42fddcc7c64b723a867c7b2f5f7505e244212f13\", \"lessThan\": \"ad7219cd8751bd258b9d1e69ae0654ec00f71875\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42fddcc7c64b723a867c7b2f5f7505e244212f13\", \"lessThan\": \"d1579253ffce39986e7a6ab757ac93b2680a665f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42fddcc7c64b723a867c7b2f5f7505e244212f13\", \"lessThan\": \"8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42fddcc7c64b723a867c7b2f5f7505e244212f13\", \"lessThan\": \"18b1ab7aa76bde181bdb1ab19a87fa9523c32f21\", \"versionType\": \"git\"}], \"programFiles\": [\"net/xdp/xsk.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/xdp/xsk.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad7219cd8751bd258b9d1e69ae0654ec00f71875\"}, {\"url\": \"https://git.kernel.org/stable/c/d1579253ffce39986e7a6ab757ac93b2680a665f\"}, {\"url\": \"https://git.kernel.org/stable/c/8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9\"}, {\"url\": \"https://git.kernel.org/stable/c/18b1ab7aa76bde181bdb1ab19a87fa9523c32f21\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxsk: Fix race at socket teardown\\n\\nFix a race in the xsk socket teardown code that can lead to a NULL pointer\\ndereference splat. The current xsk unbind code in xsk_unbind_dev() starts by\\nsetting xs-\u003estate to XSK_UNBOUND, sets xs-\u003edev to NULL and then waits for any\\nNAPI processing to terminate using synchronize_net(). After that, the release\\ncode starts to tear down the socket state and free allocated memory.\\n\\n  BUG: kernel NULL pointer dereference, address: 00000000000000c0\\n  PGD 8000000932469067 P4D 8000000932469067 PUD 0\\n  Oops: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 25 PID: 69132 Comm: grpcpp_sync_ser Tainted: G          I       5.16.0+ #2\\n  Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.2.10 03/09/2015\\n  RIP: 0010:__xsk_sendmsg+0x2c/0x690\\n  [...]\\n  RSP: 0018:ffffa2348bd13d50 EFLAGS: 00010246\\n  RAX: 0000000000000000 RBX: 0000000000000040 RCX: ffff8d5fc632d258\\n  RDX: 0000000000400000 RSI: ffffa2348bd13e10 RDI: ffff8d5fc5489800\\n  RBP: ffffa2348bd13db0 R08: 0000000000000000 R09: 00007ffffffff000\\n  R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d5fc5489800\\n  R13: ffff8d5fcb0f5140 R14: ffff8d5fcb0f5140 R15: 0000000000000000\\n  FS:  00007f991cff9400(0000) GS:ffff8d6f1f700000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 00000000000000c0 CR3: 0000000114888005 CR4: 00000000001706e0\\n  Call Trace:\\n  \u003cTASK\u003e\\n  ? aa_sk_perm+0x43/0x1b0\\n  xsk_sendmsg+0xf0/0x110\\n  sock_sendmsg+0x65/0x70\\n  __sys_sendto+0x113/0x190\\n  ? debug_smp_processor_id+0x17/0x20\\n  ? fpregs_assert_state_consistent+0x23/0x50\\n  ? exit_to_user_mode_prepare+0xa5/0x1d0\\n  __x64_sys_sendto+0x29/0x30\\n  do_syscall_64+0x3b/0xc0\\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nThere are two problems with the current code. First, setting xs-\u003edev to NULL\\nbefore waiting for all users to stop using the socket is not correct. The\\nentry to the data plane functions xsk_poll(), xsk_sendmsg(), and xsk_recvmsg()\\nare all guarded by a test that xs-\u003estate is in the state XSK_BOUND and if not,\\nit returns right away. But one process might have passed this test but still\\nhave not gotten to the point in which it uses xs-\u003edev in the code. In this\\ninterim, a second process executing xsk_unbind_dev() might have set xs-\u003edev to\\nNULL which will lead to a crash for the first process. The solution here is\\njust to get rid of this NULL assignment since it is not used anymore. Before\\ncommit 42fddcc7c64b (\\\"xsk: use state member for socket synchronization\\\"),\\nxs-\u003edev was the gatekeeper to admit processes into the data plane functions,\\nbut it was replaced with the state variable xs-\u003estate in the aforementioned\\ncommit.\\n\\nThe second problem is that synchronize_net() does not wait for any process in\\nxsk_poll(), xsk_sendmsg(), or xsk_recvmsg() to complete, which means that the\\nstate they rely on might be cleaned up prematurely. This can happen when the\\nnotifier gets called (at driver unload for example) as it uses xsk_unbind_dev().\\nSolve this by extending the RCU critical region from just the ndo_xsk_wakeup\\nto the whole functions mentioned above, so that both the test of xs-\u003estate ==\\nXSK_BOUND and the last use of any member of xs is covered by the RCU critical\\nsection. This will guarantee that when synchronize_net() completes, there will\\nbe no processes left executing xsk_poll(), xsk_sendmsg(), or xsk_recvmsg() and\\nstate can be cleaned up safely. Note that we need to drop the RCU lock for the\\nskb xmit path as it uses functions that might sleep. Due to this, we have to\\nretest the xs-\u003estate after we grab the mutex that protects the skb xmit code\\nfrom, among a number of things, an xsk_unbind_dev() being executed from the\\nnotifier at the same time.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.2\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:54:24.178Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49215\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:54:24.178Z\", \"dateReserved\": \"2025-02-26T01:49:39.292Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:55:50.154Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.