{"id":"CVE-2022-50252","state":"PUBLISHED","title":"igb: Do not free q_vector unless new one was allocated","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter->q_vector[v_idx] array position.","publishedAt":"2025-09-15T14:02:30.980Z","updatedAt":"2026-10-15T21:31:19.421Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"64ca1969599857143e91aeec4440640656100803","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"0200f0fbb11e359cc35af72ab10b2ec224e6f633","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"68e8adbcaf7a8743e473343b38b9dad66e2ac6f3","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"f96bd8adc8adde25390965a8c1ee81b73cb62075","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"3cb18dea11196fb4a06f78294cec5e61985e1aff","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"314f7092b27749bdde44c14095b5533afa2a3bc8","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"6e399577bd397a517df4b938601108c63769ce0a","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"56483aecf6b22eb7dff6315b3a174688c6ad494c","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"0668716506ca66f90d395f36ccdaebc3e0e84801","versionType":"git"},{"version":"5be042b1917ddf444c20f4e12856535307b37c01","status":"affected","versionType":"git"},{"version":"a0e26ed623a1e1460c1a191fbc0f37bddab7851a","status":"affected","versionType":"git"},{"version":"f4b7f93cd34a6153d454a837708fd4203990d1ae","status":"affected","versionType":"git"},{"version":"3.18.23","status":"affected","lessThan":"3.19","versionType":"semver"},{"version":"4.1.9","status":"affected","lessThan":"4.2","versionType":"semver"},{"version":"4.2.2","status":"affected","lessThan":"4.3","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.3","versionType":"semver"},{"version":"4.9.337","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.303","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.86","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.16","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.2","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"]}],"references":["https://git.kernel.org/stable/c/64ca1969599857143e91aeec4440640656100803","https://git.kernel.org/stable/c/0200f0fbb11e359cc35af72ab10b2ec224e6f633","https://git.kernel.org/stable/c/68e8adbcaf7a8743e473343b38b9dad66e2ac6f3","https://git.kernel.org/stable/c/f96bd8adc8adde25390965a8c1ee81b73cb62075","https://git.kernel.org/stable/c/3cb18dea11196fb4a06f78294cec5e61985e1aff","https://git.kernel.org/stable/c/314f7092b27749bdde44c14095b5533afa2a3bc8","https://git.kernel.org/stable/c/6e399577bd397a517df4b938601108c63769ce0a","https://git.kernel.org/stable/c/56483aecf6b22eb7dff6315b3a174688c6ad494c","https://git.kernel.org/stable/c/0668716506ca66f90d395f36ccdaebc3e0e84801"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50252.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50252","state":"PUBLISHED","datePublished":"2025-09-15T14:02:30.980Z","dateUpdated":"2026-10-15T21:31:19.421Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-09-15T13:58:00.973Z"},"containers":{"cna":{"title":"igb: Do not free q_vector unless new one was allocated","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter->q_vector[v_idx] array position."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"64ca1969599857143e91aeec4440640656100803","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"0200f0fbb11e359cc35af72ab10b2ec224e6f633","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"68e8adbcaf7a8743e473343b38b9dad66e2ac6f3","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"f96bd8adc8adde25390965a8c1ee81b73cb62075","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"3cb18dea11196fb4a06f78294cec5e61985e1aff","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"314f7092b27749bdde44c14095b5533afa2a3bc8","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"6e399577bd397a517df4b938601108c63769ce0a","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"56483aecf6b22eb7dff6315b3a174688c6ad494c","versionType":"git"},{"version":"72ddef0506da852dc82f078f37ced8ef4d74a2bf","status":"affected","lessThan":"0668716506ca66f90d395f36ccdaebc3e0e84801","versionType":"git"},{"version":"5be042b1917ddf444c20f4e12856535307b37c01","status":"affected","versionType":"git"},{"version":"a0e26ed623a1e1460c1a191fbc0f37bddab7851a","status":"affected","versionType":"git"},{"version":"f4b7f93cd34a6153d454a837708fd4203990d1ae","status":"affected","versionType":"git"},{"version":"3.18.23","status":"affected","lessThan":"3.19","versionType":"semver"},{"version":"4.1.9","status":"affected","lessThan":"4.2","versionType":"semver"},{"version":"4.2.2","status":"affected","lessThan":"4.3","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.3","versionType":"semver"},{"version":"4.9.337","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.303","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.270","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.229","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.163","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.86","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.0.16","status":"unaffected","lessThanOrEqual":"6.0.*","versionType":"semver"},{"version":"6.1.2","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/64ca1969599857143e91aeec4440640656100803"},{"url":"https://git.kernel.org/stable/c/0200f0fbb11e359cc35af72ab10b2ec224e6f633"},{"url":"https://git.kernel.org/stable/c/68e8adbcaf7a8743e473343b38b9dad66e2ac6f3"},{"url":"https://git.kernel.org/stable/c/f96bd8adc8adde25390965a8c1ee81b73cb62075"},{"url":"https://git.kernel.org/stable/c/3cb18dea11196fb4a06f78294cec5e61985e1aff"},{"url":"https://git.kernel.org/stable/c/314f7092b27749bdde44c14095b5533afa2a3bc8"},{"url":"https://git.kernel.org/stable/c/6e399577bd397a517df4b938601108c63769ce0a"},{"url":"https://git.kernel.org/stable/c/56483aecf6b22eb7dff6315b3a174688c6ad494c"},{"url":"https://git.kernel.org/stable/c/0668716506ca66f90d395f36ccdaebc3e0e84801"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local ethtool channel reconfiguration (ETHTOOL_SCHANNELS / ETHTOOL_MSG_CHANNELS_SET → igb_set_channels → igb_reinit_queues → igb_alloc_q_vector), not via received network packets or a remote protocol parser.\nAC:L - The attacker fully controls the ethtool -L call that grows q_vector size across the QUEUE_PAIRS threshold, and a local attacker can induce the required kzalloc() failure through memory exhaustion, so success does not depend on conditions outside their influence.\nPR:L - Triggering requires CAP_NET_ADMIN on the netns that owns the igb netdev (ns_capable / GENL_UNS_ADMIN_PERM), which is available to unprivileged userns/container tenants given an igb interface and is not full init-namespace root.\nUI:N - No separate victim action is required; the attacker issues the privileged ethtool/netlink request themselves.\nS:U - This is a host-kernel heap UAF in the igb PF driver with impact confined to the same kernel privilege domain; it is not a VM/IOMMU/sandbox boundary escape.\nC:H - The failed realloc leaves a dangling adapter->q_vector[] pointer to a freed object (including embedded rings/NAPI state), giving a classic UAF read primitive over reclaimable kernel heap memory.\nI:H - The same UAF/double-free of igb_q_vector (containing napi_struct and related pointers) is heap-sprayable into an arbitrary write / control-flow hijack, enabling code execution in kernel context.\nA:H - Use of the dangling q_vector on retry, teardown, or other driver paths causes kernel oops/panic or double-free, so availability impact is high even without a full exploit."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:57:56.935Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"4.9.337"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"4.14.303"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"4.19.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"5.4.229"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"5.10.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"5.15.86"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.0.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.1.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3","versionEndExcluding":"6.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.18.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-50252","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:30:40.430388Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:31:19.421Z"}}]}}}