{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50252","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-09-15T13:58:00.973Z","datePublished":"2025-09-15T14:02:30.980Z","dateUpdated":"2026-08-05T08:57:56.935Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:57:56.935Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter->q_vector[v_idx] array position."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local ethtool channel reconfiguration (ETHTOOL_SCHANNELS / ETHTOOL_MSG_CHANNELS_SET → igb_set_channels → igb_reinit_queues → igb_alloc_q_vector), not via received network packets or a remote protocol parser.\nAC:L - The attacker fully controls the ethtool -L call that grows q_vector size across the QUEUE_PAIRS threshold, and a local attacker can induce the required kzalloc() failure through memory exhaustion, so success does not depend on conditions outside their influence.\nPR:L - Triggering requires CAP_NET_ADMIN on the netns that owns the igb netdev (ns_capable / GENL_UNS_ADMIN_PERM), which is available to unprivileged userns/container tenants given an igb interface and is not full init-namespace root.\nUI:N - No separate victim action is required; the attacker issues the privileged ethtool/netlink request themselves.\nS:U - This is a host-kernel heap UAF in the igb PF driver with impact confined to the same kernel privilege domain; it is not a VM/IOMMU/sandbox boundary escape.\nC:H - The failed realloc leaves a dangling adapter->q_vector[] pointer to a freed object (including embedded rings/NAPI state), giving a classic UAF read primitive over reclaimable kernel heap memory.\nI:H - The same UAF/double-free of igb_q_vector (containing napi_struct and related pointers) is heap-sprayable into an arbitrary write / control-flow hijack, enabling code execution in kernel context.\nA:H - Use of the dangling q_vector on retry, teardown, or other driver paths causes kernel oops/panic or double-free, so availability impact is high even without a full exploit."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"],"versions":[{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"64ca1969599857143e91aeec4440640656100803","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"0200f0fbb11e359cc35af72ab10b2ec224e6f633","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"68e8adbcaf7a8743e473343b38b9dad66e2ac6f3","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"f96bd8adc8adde25390965a8c1ee81b73cb62075","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"3cb18dea11196fb4a06f78294cec5e61985e1aff","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"314f7092b27749bdde44c14095b5533afa2a3bc8","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"6e399577bd397a517df4b938601108c63769ce0a","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"56483aecf6b22eb7dff6315b3a174688c6ad494c","status":"affected","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","lessThan":"0668716506ca66f90d395f36ccdaebc3e0e84801","status":"affected","versionType":"git"},{"version":"5be042b1917ddf444c20f4e12856535307b37c01","status":"affected","versionType":"git"},{"version":"a0e26ed623a1e1460c1a191fbc0f37bddab7851a","status":"affected","versionType":"git"},{"version":"f4b7f93cd34a6153d454a837708fd4203990d1ae","status":"affected","versionType":"git"},{"version":"3.18.23","lessThan":"3.19","status":"affected","versionType":"semver"},{"version":"4.1.9","lessThan":"4.2","status":"affected","versionType":"semver"},{"version":"4.2.2","lessThan":"4.3","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"],"versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","status":"unaffected","versionType":"semver"},{"version":"4.9.337","lessThanOrEqual":"4.9.*","status":"unaffected","versionType":"semver"},{"version":"4.14.303","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.270","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.229","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.163","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.86","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.0.16","lessThanOrEqual":"6.0.*","status":"unaffected","versionType":"semver"},{"version":"6.1.2","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"4.9.337"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"4.14.303"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"4.19.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"5.4.229"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"5.10.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"5.15.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.1.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/64ca1969599857143e91aeec4440640656100803"},{"url":"https://git.kernel.org/stable/c/0200f0fbb11e359cc35af72ab10b2ec224e6f633"},{"url":"https://git.kernel.org/stable/c/68e8adbcaf7a8743e473343b38b9dad66e2ac6f3"},{"url":"https://git.kernel.org/stable/c/f96bd8adc8adde25390965a8c1ee81b73cb62075"},{"url":"https://git.kernel.org/stable/c/3cb18dea11196fb4a06f78294cec5e61985e1aff"},{"url":"https://git.kernel.org/stable/c/314f7092b27749bdde44c14095b5533afa2a3bc8"},{"url":"https://git.kernel.org/stable/c/6e399577bd397a517df4b938601108c63769ce0a"},{"url":"https://git.kernel.org/stable/c/56483aecf6b22eb7dff6315b3a174688c6ad494c"},{"url":"https://git.kernel.org/stable/c/0668716506ca66f90d395f36ccdaebc3e0e84801"}],"title":"igb: Do not free q_vector unless new one was allocated","x_generator":{"engine":"bippy-1.2.0"}}}}