{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-48728 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-48728 is a medium-severity vulnerability in Linux kernel, published on 20 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-48728 and fix it if it is affected.\n\nWhat it is: CVE-2022-48728 is a medium-severity vulnerability in Linux kernel, published on 20 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-48728 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-48728/ (Markdown: https://insights.sbomify.com/CVE-2022-48728/index.md)","id":"CVE-2022-48728","markdown":"https://insights.sbomify.com/CVE-2022-48728/index.md","name":"CVE-2022-48728","record":{"aliases":["DEBIAN-CVE-2022-48728","GHSA-mfmr-68wm-65f9","UBUNTU-CVE-2022-48728"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A null pointer dereference in the IB/hfi1 driver causes a kernel panic during early initialization, leading to a denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix AIP early init panic\n\nAn early failure in hfi1_ipoib_setup_rn() can lead to the following panic:\n\n  BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0\n  PGD 0 P4D 0\n  Oops: 0002 [#1] SMP NOPTI\n  Workqueue: events work_for_cpu_fn\n  RIP: 0010:try_to_grab_pending+0x2b/0x140\n  Code: 1f 44 00 00 41 55 41 54 55 48 89 d5 53 48 89 fb 9c 58 0f 1f 44 00 00 48 89 c2 fa 66 0f 1f 44 00 00 48 89 55 00 40 84 f6 75 77 \u003cf0\u003e 48 0f ba 2b 00 72 09 31 c0 5b 5d 41 5c 41 5d c3 48 89 df e8 6c\n  RSP: 0018:ffffb6b3cf7cfa48 EFLAGS: 00010046\n  RAX: 0000000000000246 RBX: 00000000000001b0 RCX: 0000000000000000\n  RDX: 0000000000000246 RSI: 0000000000000000 RDI: 00000000000001b0\n  RBP: ffffb6b3cf7cfa70 R08: 0000000000000f09 R09: 0000000000000001\n  R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000\n  R13: ffffb6b3cf7cfa90 R14: ffffffff9b2fbfc0 R15: ffff8a4fdf244690\n  FS:  0000000000000000(0000) GS:ffff8a527f400000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000000001b0 CR3: 00000017e2410003 CR4: 00000000007706f0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  PKRU: 55555554\n  Call Trace:\n   __cancel_work_timer+0x42/0x190\n   ? dev_printk_emit+0x4e/0x70\n   iowait_cancel_work+0x15/0x30 [hfi1]\n   hfi1_ipoib_txreq_deinit+0x5a/0x220 [hfi1]\n   ? dev_err+0x6c/0x90\n   hfi1_ipoib_netdev_dtor+0x15/0x30 [hfi1]\n   hfi1_ipoib_setup_rn+0x10e/0x150 [hfi1]\n   rdma_init_netdev+0x5a/0x80 [ib_core]\n   ? hfi1_ipoib_free_rdma_netdev+0x20/0x20 [hfi1]\n   ipoib_intf_init+0x6c/0x350 [ib_ipoib]\n   ipoib_intf_alloc+0x5c/0xc0 [ib_ipoib]\n   ipoib_add_one+0xbe/0x300 [ib_ipoib]\n   add_client_context+0x12c/0x1a0 [ib_core]\n   enable_device_and_get+0xdc/0x1d0 [ib_core]\n   ib_register_device+0x572/0x6b0 [ib_core]\n   rvt_register_device+0x11b/0x220 [rdmavt]\n   hfi1_register_ib_device+0x6b4/0x770 [hfi1]\n   do_init_one.isra.20+0x3e3/0x680 [hfi1]\n   local_pci_probe+0x41/0x90\n   work_for_cpu_fn+0x16/0x20\n   process_one_work+0x1a7/0x360\n   ? create_worker+0x1a0/0x1a0\n   worker_thread+0x1cf/0x390\n   ? create_worker+0x1a0/0x1a0\n   kthread+0x116/0x130\n   ? kthread_flush_work_fn+0x10/0x10\n   ret_from_fork+0x1f/0x40\n\nThe panic happens in hfi1_ipoib_txreq_deinit() because there is a NULL\nderef when hfi1_ipoib_netdev_dtor() is called in this error case.\n\nhfi1_ipoib_txreq_init() and hfi1_ipoib_rxq_init() are self unwinding so\nfix by adjusting the error paths accordingly.\n\nOther changes:\n- hfi1_ipoib_free_rdma_netdev() is deleted including the free_netdev()\n  since the netdev core code deletes calls free_netdev()\n- The switch to the accelerated entrances is moved to the success path.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"IB/hfi1: Fix AIP early init panic","id":"CVE-2022-48728","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2022"},"n_packages":0,"n_references":4,"next":{"headline":"IB/hfi1: Fix panic with larger ipoib send_queue_size","id":"CVE-2022-48729"},"packages":[],"prev":{"headline":"KVM: arm64: Avoid consuming a stale esr value when SError occur","id":"CVE-2022-48727"},"products":["Linux"],"published":"2024-06-20","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A null pointer dereference in the IB/hfi1 driver causes a kernel panic during early initialization, leading to a denial of service.","url":"https://insights.sbomify.com/CVE-2022-48728/"}