CVE-2022-49820 mctp i2c: don't count unused / invalid keys for flow release
A logic error in the Linux kernel MCTP I2C driver can trigger a warning and potential instability when releasing unused flows, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49820?
CVE-2022-49820 is a medium-severity denial of service vulnerability in Linux kernel, published on 1 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mctp i2c: don't count unused / invalid keys for flow release
We're currently hitting the WARN_ON in mctp_i2c_flow_release:
if (midev->release_count > midev->i2c_lock_count) { WARN_ONCE(1, "release count overflow");
This may be hit if we expire a flow before sending the first packet it contains - as we will not be pairing the increment of release_count (performed on flow release) with the i2c lock operation (only performed on actual TX).
To fix this, only release a flow if we've encountered it previously (ie, dev_flow_state does not indicate NEW), as we will mark the flow as ACTIVE at the same time as accounting for the i2c lock operation. We also need to add an INVALID flow state, to indicate when we've done the release.
Which versions are affected by CVE-2022-49820?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49820?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-49820 being exploited?
There is no known exploitation of CVE-2022-49820 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49820, GHSA-whp8-mg46-9399, UBUNTU-CVE-2022-49820.