CVE-2022-49958
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49958
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49958.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49958
- Related
- Published
- 2025-06-18T11:15:23Z
- Modified
- 2025-06-18T16:46:01.060829Z
- Downstream
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix netdevice reference leaks in attachdefaultqdiscs()
In attachdefaultqdiscs(), if a dev has multiple queues and queue 0 fails to attach qdisc because there is no memory in attachonedefaultqdisc(). Then dev->qdisc will be noopqdisc by default. But the other queues may be able to successfully attach to default qdisc.
In this case, the fallback to noqueue process will be triggered. If the original attached qdisc is not released and a new one is directly attached, this will cause netdevice reference leaks.
The following is the bug log:
veth0: default qdisc (fqcodel) fail, fallback to noqueue unregisternetdevice: waiting for veth0 to become free. Usage count = 32 leaked reference. qdiscalloc+0x12e/0x210 qdisccreatedflt+0x62/0x140 attachonedefaultqdisc.constprop.41+0x44/0x70 devactivate+0x128/0x290 devopen+0x12a/0x190 _devchangeflags+0x1a2/0x1f0 devchangeflags+0x23/0x60 dosetlink+0x332/0x1150 _rtnlnewlink+0x52f/0x8e0 rtnlnewlink+0x43/0x70 rtnetlinkrcvmsg+0x140/0x3b0 netlinkrcvskb+0x50/0x100 netlinkunicast+0x1bb/0x290 netlinksendmsg+0x37c/0x4e0 socksendmsg+0x5f/0x70 sys_sendmsg+0x208/0x280
Fix this bug by clearing any non-noop qdiscs that may have been assigned before trying to re-attach.
- References
-
- https://git.kernel.org/stable/c/0c6c522857151ac00150fd01baeebf231fb7d142
- https://git.kernel.org/stable/c/44dfa645895a56f65461249deb5b81cd16560e2a
- https://git.kernel.org/stable/c/a420d587260185407eda9c5766cfa9bdd5c39a56
- https://git.kernel.org/stable/c/f612466ebecb12a00d9152344ddda6f6345f04dc
- https://security-tracker.debian.org/tracker/CVE-2022-49958
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.148-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source