CVE-2022-48896 ixgbe: fix pci device refcount leak
A missing reference count decrement in the ixgbe network driver can lead to a memory leak, potentially causing resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48896?
CVE-2022-48896 is a medium-severity denial of service vulnerability in Linux kernel, published on 21 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ixgbe: fix pci device refcount leak
As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pci_dev_put().
In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), pci_dev_put() is called to avoid leak.
Weakness: CWE-401
Which versions are affected by CVE-2022-48896?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48896?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-48896 being exploited?
There is no known exploitation of CVE-2022-48896 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48896, GHSA-mf9q-63r7-3j6h, UBUNTU-CVE-2022-48896.