CVE-2022-48690

ice: Fix DMA mappings leak

MEDIUM
5.5
CVSS Score
Published: May 3, 2024 at 05:44 PM UTC
Updated: June 17, 2026 at 05:15 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ice: Fix DMA mappings leak Fix leak, when user changes ring parameters. During reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with different RX ring count should substitute older ones, but those buffers were freed in ice_vsi_cfg_rxq and reallocated again with ice_alloc_rx_buf. kfree on rx_buf caused leak of already mapped DMA. Reallocate ZC with xdp_buf struct, when BPF program loads. Reallocate back to rx_buf, when BPF program unloads. If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XDP_SETUP_XSK_POOL handler. Steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.16 ≤ v < 5.19.95.16 ≤ v < 6.05.16.1 ≤ v < 5.19.95.165.16 rc75.16 rc86.0 rc16.0 rc26.0 rc36.0 rc4617f3e1b588c802517c236087561c6bcb0b4afd6
Vendor states this is fixed in 07f40e9f0ff342eb3e97d5c544783b7cb641689c (fixed)
Vendor states this is fixed in 7e753eb675f0523207b184558638ee2eed6c9ac2 (fixed)
Vendor states this is fixed in 5.16 (unaffected)
Vendor states this is fixed in 5.19.9 (unaffected)
Vendor states this is fixed in 6.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (2)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/07f40e9f0ff342eb3e97d5c544783b7cb641689c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7e753eb675f0523207b184558638ee2eed6c9ac2

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card