Read the docs
TI-2022-24460 Aliases CVE-2022-48941GHSA-2862-5xjv-8phr

ice: fix concurrent reset and removal of VFs

Priority LOW 37CWE-362Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: ice: fix concurrent reset and removal of VFs Commit c503e63200c6 ("ice: Stop processing VF messages during teardown") introduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is intended to prevent some issues with concurrently handling messages from VFs while tearing down the VFs. This change was motivated by crashes caused while tearing down and bringing up VFs in rapid succession. It turns out that the fix actually introduces issues with the VF driver caused because the PF no longer responds to any messages sent by the VF during its .remove routine. This results in the VF potentially removing its DMA memory before the PF has shut down the device queues. Additionally, the fix doesn't actually resolve concurrency issues within the ice driver. It is possible for a VF to initiate a reset just prior to the ice driver removing VFs. This can result in the remove task concurrently operating while the VF is being reset. This results in similar memory corruption and panics purportedly fixed by that commit. Fix this concurrency at its root by protecting both the reset and removal flows using the existing VF cfg_lock. This ensures that we cannot remove the VF while any outstanding critical tasks such as a virtchnl message or a reset are occurring. This locking change also fixes the root cause originally fixed by commit c503e63200c6 ("ice: Stop processing VF messages during teardown"), so we can simply revert it. Note that I kept these two changes together because simply reverting the original commit alone would leave the driver vulnerable to worse race conditions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.14, 5.15.26, 5.16.12 +1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.13.12 to before 5.145.14Patch availableCNA
LinuxLinux5.14 and later5.15.26, 5.16.12, 5.17Patch availableCNA
  • Linux VendorLinux Affected 5.13.12 to before 5.14 Fixed in 5.14 Patch available CNA
  • Linux VendorLinux Affected 5.14 and later Fixed in 5.15.26, 5.16.12, 5.17 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*before 5.10.104; 5.11 to before 5.15.26; 5.16 to before 5.16.12VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 5.10.104; 5.11 to before 5.15.26; 5.16 to before 5.16.12 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.14
  • Fix · CNA Linux (Linux) Fixed in 5.15.26, 5.16.12, 5.17

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-48941
  2. 2026-10-03 Alias added: GHSA-2862-5xjv-8phr

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources