CVE-2022-49905 (GCVE-0-2022-49905)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:10 – Updated: 2026-08-05 08:56
VLAI
Title
net/smc: Fix possible leaked pernet namespace in smc_init()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible leaked pernet namespace in smc_init() In smc_init(), register_pernet_subsys(&smc_net_stat_ops) is called without any error handling. If it fails, registering of &smc_net_ops won't be reverted. And if smc_nl_init() fails, &smc_net_stat_ops itself won't be reverted. This leaves wild ops in subsystem linkedlist and when another module tries to call register_pernet_operations() it triggers page fault: BUG: unable to handle page fault for address: fffffbfff81b964c RIP: 0010:register_pernet_operations+0x1b9/0x5f0 Call Trace: <TASK> register_pernet_subsys+0x29/0x40 ebtables_init+0x58/0x1000 [ebtables] ...
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 194730a9beb52d2b030ea45e12d94868d4a0e6fd , < 61defd6450a9ef4a1487090449999b0fd83518ef (git)
Affected: 194730a9beb52d2b030ea45e12d94868d4a0e6fd , < c97daf836f7caf81d3144b8cd2b2a51f9bc3bd09 (git)
Affected: 194730a9beb52d2b030ea45e12d94868d4a0e6fd , < 62ff373da2534534c55debe6c724c7fe14adb97f (git)
Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.78 , ≤ 5.15.* (semver)
Unaffected: 6.0.8 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "61defd6450a9ef4a1487090449999b0fd83518ef",
              "status": "affected",
              "version": "194730a9beb52d2b030ea45e12d94868d4a0e6fd",
              "versionType": "git"
            },
            {
              "lessThan": "c97daf836f7caf81d3144b8cd2b2a51f9bc3bd09",
              "status": "affected",
              "version": "194730a9beb52d2b030ea45e12d94868d4a0e6fd",
              "versionType": "git"
            },
            {
              "lessThan": "62ff373da2534534c55debe6c724c7fe14adb97f",
              "status": "affected",
              "version": "194730a9beb52d2b030ea45e12d94868d4a0e6fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.78",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix possible leaked pernet namespace in smc_init()\n\nIn smc_init(), register_pernet_subsys(\u0026smc_net_stat_ops) is called\nwithout any error handling.\nIf it fails, registering of \u0026smc_net_ops won\u0027t be reverted.\nAnd if smc_nl_init() fails, \u0026smc_net_stat_ops itself won\u0027t be reverted.\n\nThis leaves wild ops in subsystem linkedlist and when another module\ntries to call register_pernet_operations() it triggers page fault:\n\nBUG: unable to handle page fault for address: fffffbfff81b964c\nRIP: 0010:register_pernet_operations+0x1b9/0x5f0\nCall Trace:\n  \u003cTASK\u003e\n  register_pernet_subsys+0x29/0x40\n  ebtables_init+0x58/0x1000 [ebtables]\n  ..."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in smc_init() module/subsystem initialization and is reached via local actions such as socket(AF_SMC) module autoload (net-pf-43) or TCP_ULP \"smc\", not by processing remote packets.\nAC:L - An unprivileged local attacker can induce smc_init() failure (e.g., memory pressure on the many GFP_KERNEL allocations and registrations in the init path) and then trigger the dangling ops via netns creation or another pernet registration, without relying on conditions outside their control.\nPR:L - No CAP_SYS_MODULE is required: an unprivileged user can request_module via AF_SMC socket creation, and can create network namespaces through user namespaces to exercise the leaked pernet ops.\nUI:N - Exploitation requires no victim interaction; the attacker triggers module autoload and subsequent pernet list use themselves.\nS:U - Impact is confined to the host kernel authority (oops or privilege escalation within the same kernel); it does not cross a VM/host or other security boundary.\nC:H - Failed modular init frees the module while smc_net_ops or smc_net_stat_ops remain linked, yielding a use-after-free of pernet_operations (including function pointers) that can be reclaimed/sprayed for arbitrary kernel read primitives.\nI:H - The same dangling pernet_operations-\u003einit/exit pointers are invoked from setup_net()/register_pernet_operations(), so controlling the freed object enables arbitrary write and control-flow hijacking.\nA:H - The issue produces a kernel page fault/oops when another subsystem walks the corrupted pernet list (as shown with ebtables_init), which is a full availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:38.460Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/61defd6450a9ef4a1487090449999b0fd83518ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/c97daf836f7caf81d3144b8cd2b2a51f9bc3bd09"
        },
        {
          "url": "https://git.kernel.org/stable/c/62ff373da2534534c55debe6c724c7fe14adb97f"
        }
      ],
      "title": "net/smc: Fix possible leaked pernet namespace in smc_init()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49905",
    "datePublished": "2025-05-01T14:10:49.621Z",
    "dateReserved": "2025-05-01T14:05:17.246Z",
    "dateUpdated": "2026-08-05T08:56:38.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49905",
      "date": "2026-10-02",
      "epss": "0.0021",
      "percentile": "0.10222"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/af_smc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "61defd6450a9ef4a1487090449999b0fd83518ef",
                    "status": "affected",
                    "version": "194730a9beb52d2b030ea45e12d94868d4a0e6fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c97daf836f7caf81d3144b8cd2b2a51f9bc3bd09",
                    "status": "affected",
                    "version": "194730a9beb52d2b030ea45e12d94868d4a0e6fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "62ff373da2534534c55debe6c724c7fe14adb97f",
                    "status": "affected",
                    "version": "194730a9beb52d2b030ea45e12d94868d4a0e6fd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/af_smc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.78",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4A83CCE5-725E-495E-A0C2-C673EA7B658A",
                    "versionEndExcluding": "5.15.78",
                    "versionStartIncluding": "5.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EC9A754E-625D-42F3-87A7-960D643E2867",
                    "versionEndExcluding": "6.0.8",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Fix possible leaked pernet namespace in smc_init()\n\nIn smc_init(), register_pernet_subsys(\u0026smc_net_stat_ops) is called\nwithout any error handling.\nIf it fails, registering of \u0026smc_net_ops won\u0027t be reverted.\nAnd if smc_nl_init() fails, \u0026smc_net_stat_ops itself won\u0027t be reverted.\n\nThis leaves wild ops in subsystem linkedlist and when another module\ntries to call register_pernet_operations() it triggers page fault:\n\nBUG: unable to handle page fault for address: fffffbfff81b964c\nRIP: 0010:register_pernet_operations+0x1b9/0x5f0\nCall Trace:\n  \u003cTASK\u003e\n  register_pernet_subsys+0x29/0x40\n  ebtables_init+0x58/0x1000 [ebtables]\n  ..."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/smc: Se corrige una posible fuga de espacio de nombres pernet en smc_init(). En smc_init(), se llama a register_pernet_subsys(\u0026amp;smc_net_stat_ops) sin gestionar errores. Si falla, el registro de \u0026amp;smc_net_ops no se revertir\u00e1. Y si smc_nl_init() falla, \u0026amp;smc_net_stat_ops no se revertir\u00e1. Esto deja operaciones salvajes en la lista enlazada del subsistema y cuando otro m\u00f3dulo intenta llamar a register_pernet_operations() desencadena un error de p\u00e1gina: ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: fffffbfff81b964c RIP: 0010:register_pernet_operations+0x1b9/0x5f0 Rastreo de llamada:  register_pernet_subsys+0x29/0x40 ebtables_init+0x58/0x1000 [ebtables] ... "
          }
        ],
        "id": "CVE-2022-49905",
        "lastModified": "2026-08-04T10:17:58.857",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-01T15:16:15.593",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/61defd6450a9ef4a1487090449999b0fd83518ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/62ff373da2534534c55debe6c724c7fe14adb97f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c97daf836f7caf81d3144b8cd2b2a51f9bc3bd09"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:42:28+00:00",
      "cve": "CVE-2022-49905",
      "id": "CVE-2022-49905",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: Fix possible leaked pernet namespace in smc_init()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49905.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.