CVE-2022-50058 vdpa_sim_blk: set number of address spaces and virtqueue groups
A missing initialization in the Linux kernel's vdpa_sim_blk driver causes a null pointer dereference and kernel panic when adding a device.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50058?
CVE-2022-50058 is a medium-severity vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vdpa_sim_blk: set number of address spaces and virtqueue groups
Commit bda324fd037a ("vdpasim: control virtqueue support") added two new fields (nas, ngroups) to vdpasim_dev_attr, but we forgot to initialize them for vdpa_sim_blk.
When creating a new vdpa_sim_blk device this causes the kernel to panic in this way: $ vdpa dev add mgmtdev vdpasim_blk name blk0 BUG: kernel NULL pointer dereference, address: 0000000000000030 ... RIP: 0010:vhost_iotlb_add_range_ctx+0x41/0x220 [vhost_iotlb] ... Call Trace: <TASK> vhost_iotlb_add_range+0x11/0x800 [vhost_iotlb] vdpasim_map_range+0x91/0xd0 [vdpa_sim] vdpasim_alloc_coherent+0x56/0x90 [vdpa_sim] ...
This happens because vdpasim->iommu[0] is not initialized when dev_attr.nas is 0.
Let's fix this issue by initializing both (nas, ngroups) to 1 for vdpa_sim_blk.
Weakness: CWE-476
Which versions are affected by CVE-2022-50058?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50058?
Apply the vendor's patch.
Is CVE-2022-50058 being exploited?
There is no known exploitation of CVE-2022-50058 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50058, GHSA-q8cf-83hq-3865, UBUNTU-CVE-2022-50058.