{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-49972",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-06-18T10:57:27.384Z",
        "datePublished": "2025-06-18T11:00:35.382Z",
        "dateUpdated": "2026-08-05T08:56:56.871Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T08:56:56.871Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix corrupted packets for XDP_SHARED_UMEM\n\nFix an issue in XDP_SHARED_UMEM mode together with aligned mode where\npackets are corrupted for the second and any further sockets bound to\nthe same umem. In other words, this does not affect the first socket\nbound to the umem. The culprit for this bug is that the initialization\nof the DMA addresses for the pre-populated xsk buffer pool entries was\nnot performed for any socket but the first one bound to the umem. Only\nthe linear array of DMA addresses was populated. Fix this by populating\nthe DMA addresses in the xsk buffer pool for every socket bound to the\nsame umem."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The bug is triggered by creating and binding AF_XDP sockets with XDP_SHARED_UMEM via local syscalls (socket/setsockopt/bind), not by processing unsolicited remote packets alone.\nAC:L - An attacker who can open AF_XDP sockets reliably triggers the bug by binding a second aligned-mode shared-UMEM socket to another queue on the same ZC-capable device; no race or attacker-uncontrollable condition is required.\nPR:L - AF_XDP creation only requires CAP_NET_RAW via ns_capable(net->user_ns, CAP_NET_RAW), which an unprivileged user can obtain in a user namespace or a container granted NET_RAW, so privileges are Low rather than real host root.\nUI:N - Exploitation requires only the attacker’s own socket setup and traffic on the affected queue; no separate victim action is needed.\nS:U - Impact stays within the host kernel/device security authority (wrong DMA addresses on the local NIC); it does not cross a VM, IOMMU guest boundary, or other security scope.\nC:H - Uninitialized DMA fields remain zero and are used by drivers (e.g. xsk_buff_xdp_get_dma / XDP_TX paths), so the NIC can read from the wrong bus address and disclose memory contents; treat as High under the overestimate rule for DMA misuse.\nI:H - RX paths program descriptors from xskb->frame_dma before it is initialized, so the NIC can DMA-write packet data to the wrong address and corrupt memory; that is High integrity impact.\nA:H - Bad DMA programming can cause IOMMU faults, device failures, kernel instability, or oopses, which is High availability impact."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/xdp/xsk_buff_pool.c"
                    ],
                    "versions": [
                        {
                            "version": "94033cd8e73b8632bab7c8b7bb54caa4f5616db7",
                            "lessThan": "2c75891d56ab6fe5ba0d415bfad91d514a4027cd",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "94033cd8e73b8632bab7c8b7bb54caa4f5616db7",
                            "lessThan": "58ca14ed98c87cfe0d1408cc65a9745d9e9b7a56",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/xdp/xsk_buff_pool.c"
                    ],
                    "versions": [
                        {
                            "version": "5.16",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.16",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.19.8",
                            "lessThanOrEqual": "5.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.16",
                                    "versionEndExcluding": "5.19.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.16",
                                    "versionEndExcluding": "6.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/2c75891d56ab6fe5ba0d415bfad91d514a4027cd"
                },
                {
                    "url": "https://git.kernel.org/stable/c/58ca14ed98c87cfe0d1408cc65a9745d9e9b7a56"
                }
            ],
            "title": "xsk: Fix corrupted packets for XDP_SHARED_UMEM",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}