CVE-2022-49492

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49492
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49492.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-49492
Downstream
Related
Published
2025-02-26T07:01:25Z
Modified
2025-10-01T20:16:29Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix a NULL pointer dereference in nvmeallocadmin_tags

In nvmeallocadmintags, the adminq can be set to an error (typically -ENOMEM) if the blkmqinitqueue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the stack, to nvmeresetwork the error takes us to nvmeremovedeadctrl() nvmedevdisable() nvmesuspendqueue(&dev->queues[0]).

Here, we only check that the admin_q is non-NULL, rather than not an error or NULL, and begin quiescing a queue that never existed, leading to bad / NULL pointer dereference.

References

Affected packages