{"id":"CVE-2022-49840","state":"PUBLISHED","title":"bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()\n\nWe got a syzkaller problem because of aarch64 alignment fault\nif KFENCE enabled. When the size from user bpf program is an odd\nnumber, like 399, 407, etc, it will cause the struct skb_shared_info's\nunaligned access. As seen below:\n\n  BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032\n\n  Use-after-free read at 0xffff6254fffac077 (in kfence-#213):\n   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]\n   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]\n   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]\n   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]\n   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032\n   skb_clone+0xf4/0x214 net/core/skbuff.c:1481\n   ____bpf_clone_redirect net/core/filter.c:2433 [inline]\n   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420\n   bpf_prog_d3839dd9068ceb51+0x80/0x330\n   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]\n   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53\n   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594\n   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]\n   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]\n   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381\n\n  kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512\n\n  allocated by task 15074 on cpu 0 at 1342.585390s:\n   kmalloc include/linux/slab.h:568 [inline]\n   kzalloc include/linux/slab.h:675 [inline]\n   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191\n   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512\n   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]\n   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]\n   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381\n   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381\n\nTo fix the problem, we adjust @size so that (@size + @hearoom) is a\nmultiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info\nis aligned to a cache line.","publishedAt":"2025-05-01T14:09:56.233Z","updatedAt":"2026-05-11T19:07:47.558Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"047824a730699c6c66df43306b80f700c9dfc2fd","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"730fb1ef974a13915bc7651364d8b3318891cd70","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"7a704dbfd3735304e261f2787c52fbc7c3884736","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"e60f37a1d379c821c17b08f366412dce9ef3d99f","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"eaa8edd86514afac9deb9bf9a5053e74f37edf40","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"1b597f2d6a55e9f549989913860ad5170da04964","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"d3fd203f36d46aa29600a72d57a1b61af80e4a25","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bpf/test_run.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.12","versionType":"semver"},{"version":"4.14.300","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.267","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.225","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.156","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.80","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.10","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bpf/test_run.c"]}],"references":["https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd","https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70","https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736","https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f","https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40","https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964","https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/49xxx/CVE-2022-49840.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49840","state":"PUBLISHED","datePublished":"2025-05-01T14:09:56.233Z","dateUpdated":"2026-05-11T19:07:47.558Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-05-01T14:05:17.229Z"},"containers":{"cna":{"title":"bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()\n\nWe got a syzkaller problem because of aarch64 alignment fault\nif KFENCE enabled. When the size from user bpf program is an odd\nnumber, like 399, 407, etc, it will cause the struct skb_shared_info's\nunaligned access. As seen below:\n\n  BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032\n\n  Use-after-free read at 0xffff6254fffac077 (in kfence-#213):\n   __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:26 [inline]\n   arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]\n   arch_atomic_inc include/linux/atomic-arch-fallback.h:270 [inline]\n   atomic_inc include/asm-generic/atomic-instrumented.h:241 [inline]\n   __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032\n   skb_clone+0xf4/0x214 net/core/skbuff.c:1481\n   ____bpf_clone_redirect net/core/filter.c:2433 [inline]\n   bpf_clone_redirect+0x78/0x1c0 net/core/filter.c:2420\n   bpf_prog_d3839dd9068ceb51+0x80/0x330\n   bpf_dispatcher_nop_func include/linux/bpf.h:728 [inline]\n   bpf_test_run+0x3c0/0x6c0 net/bpf/test_run.c:53\n   bpf_prog_test_run_skb+0x638/0xa7c net/bpf/test_run.c:594\n   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]\n   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]\n   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381\n\n  kfence-#213: 0xffff6254fffac000-0xffff6254fffac196, size=407, cache=kmalloc-512\n\n  allocated by task 15074 on cpu 0 at 1342.585390s:\n   kmalloc include/linux/slab.h:568 [inline]\n   kzalloc include/linux/slab.h:675 [inline]\n   bpf_test_init.isra.0+0xac/0x290 net/bpf/test_run.c:191\n   bpf_prog_test_run_skb+0x11c/0xa7c net/bpf/test_run.c:512\n   bpf_prog_test_run kernel/bpf/syscall.c:3148 [inline]\n   __do_sys_bpf kernel/bpf/syscall.c:4441 [inline]\n   __se_sys_bpf+0xad0/0x1634 kernel/bpf/syscall.c:4381\n   __arm64_sys_bpf+0x50/0x60 kernel/bpf/syscall.c:4381\n\nTo fix the problem, we adjust @size so that (@size + @hearoom) is a\nmultiple of SMP_CACHE_BYTES. So we make sure the struct skb_shared_info\nis aligned to a cache line."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"047824a730699c6c66df43306b80f700c9dfc2fd","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"730fb1ef974a13915bc7651364d8b3318891cd70","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"7a704dbfd3735304e261f2787c52fbc7c3884736","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"e60f37a1d379c821c17b08f366412dce9ef3d99f","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"eaa8edd86514afac9deb9bf9a5053e74f37edf40","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"1b597f2d6a55e9f549989913860ad5170da04964","versionType":"git"},{"version":"1cf1cae963c2e6032aebe1637e995bc2f5d330f4","status":"affected","lessThan":"d3fd203f36d46aa29600a72d57a1b61af80e4a25","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bpf/test_run.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.12","versionType":"semver"},{"version":"4.14.300","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.267","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.225","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.156","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.80","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.10","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bpf/test_run.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/047824a730699c6c66df43306b80f700c9dfc2fd"},{"url":"https://git.kernel.org/stable/c/730fb1ef974a13915bc7651364d8b3318891cd70"},{"url":"https://git.kernel.org/stable/c/7a704dbfd3735304e261f2787c52fbc7c3884736"},{"url":"https://git.kernel.org/stable/c/e60f37a1d379c821c17b08f366412dce9ef3d99f"},{"url":"https://git.kernel.org/stable/c/eaa8edd86514afac9deb9bf9a5053e74f37edf40"},{"url":"https://git.kernel.org/stable/c/1b597f2d6a55e9f549989913860ad5170da04964"},{"url":"https://git.kernel.org/stable/c/d3fd203f36d46aa29600a72d57a1b61af80e4a25"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T19:07:47.558Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"4.14.300"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"4.19.267"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.4.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.10.156"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.15.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-10-01T17:01:06.257546Z","id":"CVE-2022-49840","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","type":"CWE","lang":"en","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T17:01:08.580Z"}}]}}}