GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49667 (GCVE-0-2022-49667)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:24 – Updated: 2026-08-05 08:55
VLAI
Title
net: bonding: fix use-after-free after 802.3ad slave unbind
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg(). The KASAN logs are as follows: [ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:15 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < b90ac60303063a43e17dd4aec159067599d255e6 (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < f162f7c348fa2a5555bafdb5cc890b89b221e69c (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < 893825289ba840afd86bfffcb6f7f363c73efff8 (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < 63b2fe509f69b90168a75e04e14573dccf7984e6 (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < ef0af7d08d26c5333ff4944a559279464edf6f15 (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < 2765749def4765c5052a4c66445cf4c96fcccdbc (git)
Affected: 0622cab0341cac6b30da177b0faa39fae0680e71 , < 050133e1aa2cb49bb17be847d48a4431598ef562 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 4.9.322 , ≤ 4.9.* (semver)
Unaffected: 4.14.287 , ≤ 4.14.* (semver)
Unaffected: 4.19.251 , ≤ 4.19.* (semver)
Unaffected: 5.4.204 , ≤ 5.4.* (semver)
Unaffected: 5.10.129 , ≤ 5.10.* (semver)
Unaffected: 5.15.53 , ≤ 5.15.* (semver)
Unaffected: 5.18.10 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:15:14.271545Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:31.234Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_3ad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "b90ac60303063a43e17dd4aec159067599d255e6",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "f162f7c348fa2a5555bafdb5cc890b89b221e69c",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "893825289ba840afd86bfffcb6f7f363c73efff8",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "63b2fe509f69b90168a75e04e14573dccf7984e6",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "ef0af7d08d26c5333ff4944a559279464edf6f15",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "2765749def4765c5052a4c66445cf4c96fcccdbc",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            },
            {
              "lessThan": "050133e1aa2cb49bb17be847d48a4431598ef562",
              "status": "affected",
              "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_3ad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.322",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.322",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.287",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.251",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.204",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.129",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.53",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.10",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free after 802.3ad slave unbind\n\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\"),\nresolve case, when there is several aggregation groups in the same bond.\nbond_3ad_unbind_slave will invalidate (clear) aggregator when\n__agg_active_ports return zero. So, ad_clear_agg can be executed even, when\nnum_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,\npreviously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave\nwill not update slave ports list, because lag_ports==NULL. So, here we\ngot slave ports, pointing to freed aggregator memory.\n\nFix with checking actual number of ports in group (as was before\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\") ),\nbefore ad_clear_agg().\n\nThe KASAN logs are as follows:\n\n[  767.617392] ==================================================================\n[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470\n[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767\n[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15\n[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler\n[  767.666468] Call trace:\n[  767.668930]  dump_backtrace+0x0/0x2d0\n[  767.672625]  show_stack+0x24/0x30\n[  767.675965]  dump_stack_lvl+0x68/0x84\n[  767.679659]  print_address_description.constprop.0+0x74/0x2b8\n[  767.685451]  kasan_report+0x1f0/0x260\n[  767.689148]  __asan_load2+0x94/0xd0\n[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is triggered by bond slave release (SIOCBONDRELEASE/rtnetlink ndo_del_slave \u2192 bond_3ad_unbind_slave), which requires local netlink/ioctl access; LACPDU traffic alone cannot unbind slaves.\nAC:L - An attacker who can manage the bond fully controls the trigger sequence\u2014create an 802.3ad bond, form multi-port aggregators via crafted LACPDUs on veth peers, force ports inactive, then unbind slaves\u2014so success does not depend on external timing or state.\nPR:L - Creating bonds, enslaving/releasing veth/dummy slaves, and related netlink ops only need CAP_NET_ADMIN in the network namespace\u2019s user_ns (ns_capable), which an unprivileged user obtains via user+net namespaces.\nUI:N - Exploitation is entirely attacker-driven through local namespace and interface operations; no separate victim action is required.\nS:U - Impact is kernel memory corruption and privilege escalation within the same host kernel authority, with no VM/IOMMU or cross-boundary escape.\nC:H - Use-after-free of heap-allocated struct ad_slave_info/aggregator lets an attacker reclaim and control the freed object, enabling arbitrary kernel reads.\nI:H - The same UAF is exploitable for heap spray and arbitrary write / control-flow hijacking in kernel context.\nA:H - The dangling aggregator pointer is dereferenced by bond_3ad_state_machine_handler (KASAN-confirmed), causing kernel oops/panic even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:58.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c"
        },
        {
          "url": "https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8"
        },
        {
          "url": "https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15"
        },
        {
          "url": "https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562"
        }
      ],
      "title": "net: bonding: fix use-after-free after 802.3ad slave unbind",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49667",
    "datePublished": "2025-02-26T02:24:01.818Z",
    "dateReserved": "2025-02-26T02:21:30.436Z",
    "dateUpdated": "2026-08-05T08:55:58.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49667",
      "date": "2026-09-19",
      "epss": "0.00289",
      "percentile": "0.21712"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/bonding/bond_3ad.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b90ac60303063a43e17dd4aec159067599d255e6",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f162f7c348fa2a5555bafdb5cc890b89b221e69c",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "893825289ba840afd86bfffcb6f7f363c73efff8",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63b2fe509f69b90168a75e04e14573dccf7984e6",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ef0af7d08d26c5333ff4944a559279464edf6f15",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2765749def4765c5052a4c66445cf4c96fcccdbc",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "050133e1aa2cb49bb17be847d48a4431598ef562",
                    "status": "affected",
                    "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/bonding/bond_3ad.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.322",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.287",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.251",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.204",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.129",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4226359-06D5-41B1-B299-5B0357988B43",
                    "versionEndExcluding": "4.9.322",
                    "versionStartIncluding": "4.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "73A0453B-4AA7-4F16-B8F2-4DDB2510943D",
                    "versionEndExcluding": "4.14.287",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83E1438F-F12B-4581-9EF4-B104DAEFFD41",
                    "versionEndExcluding": "4.19.251",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "73056417-5BD5-453F-8EEC-2D5C48185372",
                    "versionEndExcluding": "5.4.204",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DAAE3E52-3C60-40CA-A245-AE5660F45CD8",
                    "versionEndExcluding": "5.10.129",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "70DCF327-F4B6-4CDB-8C9E-98E909E60127",
                    "versionEndExcluding": "5.15.53",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8261A22B-B156-4045-AE8E-AA9E95E7930C",
                    "versionEndExcluding": "5.18.10",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free after 802.3ad slave unbind\n\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\"),\nresolve case, when there is several aggregation groups in the same bond.\nbond_3ad_unbind_slave will invalidate (clear) aggregator when\n__agg_active_ports return zero. So, ad_clear_agg can be executed even, when\nnum_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,\npreviously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave\nwill not update slave ports list, because lag_ports==NULL. So, here we\ngot slave ports, pointing to freed aggregator memory.\n\nFix with checking actual number of ports in group (as was before\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\") ),\nbefore ad_clear_agg().\n\nThe KASAN logs are as follows:\n\n[  767.617392] ==================================================================\n[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470\n[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767\n[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15\n[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler\n[  767.666468] Call trace:\n[  767.668930]  dump_backtrace+0x0/0x2d0\n[  767.672625]  show_stack+0x24/0x30\n[  767.675965]  dump_stack_lvl+0x68/0x84\n[  767.679659]  print_address_description.constprop.0+0x74/0x2b8\n[  767.685451]  kasan_report+0x1f0/0x260\n[  767.689148]  __asan_load2+0x94/0xd0\n[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c (\"bonding: fix 802.3ad gregator reselection\"), resuelve el caso, cuando hay varios grupos de agregaci\u00f3n en el mismo enlace. bond_3ad_unbind_slave invalidar\u00e1 (borrar\u00e1) el agregador cuando __agg_active_ports devuelva cero. Por lo tanto, ad_clear_agg se puede ejecutar incluso, cuando num_of_ports!=0. Luego, bond_3ad_unbind_slave se puede ejecutar nuevamente para el agregador previamente borrado. NOTA: en este momento bond_3ad_unbind_slave no actualizar\u00e1 la lista de puertos esclavos, porque lag_ports==NULL. Entonces, aqu\u00ed tenemos puertos esclavos, apuntando a la memoria liberada del agregador. Correcci\u00f3n con la verificaci\u00f3n del n\u00famero real de puertos en el grupo (como era antes de el commit 0622cab0341c (\"vinculaci\u00f3n: correcci\u00f3n de la reselecci\u00f3n del agregador 802.3ad\")), antes de ad_clear_agg(). Los registros de KASAN son los siguientes: [ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 "
          }
        ],
        "id": "CVE-2022-49667",
        "lastModified": "2026-06-17T05:18:47.747",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49667",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:15:14.271545Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:41.687",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:14:46+00:00",
      "cve": "CVE-2022-49667",
      "id": "CVE-2022-49667",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "164",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: bonding: fix use-after-free after 802.3ad slave unbind",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49667.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:26:24Z",
      "cve": "CVE-2022-49667",
      "id": "CVE-2022-49667",
      "initial_release_date": "2025-02-27T03:03:11Z",
      "product_status:known_affected": "540",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "263",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49667",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49667.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49667",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-27T18:15:14.271545Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-27T18:15:15.681Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/bonding/bond_3ad.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "b90ac60303063a43e17dd4aec159067599d255e6",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "f162f7c348fa2a5555bafdb5cc890b89b221e69c",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "893825289ba840afd86bfffcb6f7f363c73efff8",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "63b2fe509f69b90168a75e04e14573dccf7984e6",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "ef0af7d08d26c5333ff4944a559279464edf6f15",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "2765749def4765c5052a4c66445cf4c96fcccdbc",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                },
                {
                  "lessThan": "050133e1aa2cb49bb17be847d48a4431598ef562",
                  "status": "affected",
                  "version": "0622cab0341cac6b30da177b0faa39fae0680e71",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/bonding/bond_3ad.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.7"
                },
                {
                  "lessThan": "4.7",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.322",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.287",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.251",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.204",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.129",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.53",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.322",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.287",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.251",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.204",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.129",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.53",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.10",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19",
                      "versionStartIncluding": "4.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free after 802.3ad slave unbind\n\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\"),\nresolve case, when there is several aggregation groups in the same bond.\nbond_3ad_unbind_slave will invalidate (clear) aggregator when\n__agg_active_ports return zero. So, ad_clear_agg can be executed even, when\nnum_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,\npreviously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave\nwill not update slave ports list, because lag_ports==NULL. So, here we\ngot slave ports, pointing to freed aggregator memory.\n\nFix with checking actual number of ports in group (as was before\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\") ),\nbefore ad_clear_agg().\n\nThe KASAN logs are as follows:\n\n[  767.617392] ==================================================================\n[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470\n[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767\n[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15\n[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler\n[  767.666468] Call trace:\n[  767.668930]  dump_backtrace+0x0/0x2d0\n[  767.672625]  show_stack+0x24/0x30\n[  767.675965]  dump_stack_lvl+0x68/0x84\n[  767.679659]  print_address_description.constprop.0+0x74/0x2b8\n[  767.685451]  kasan_report+0x1f0/0x260\n[  767.689148]  __asan_load2+0x94/0xd0\n[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T08:42:54.979Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e"
            },
            {
              "url": "https://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6"
            },
            {
              "url": "https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c"
            },
            {
              "url": "https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8"
            },
            {
              "url": "https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6"
            },
            {
              "url": "https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15"
            },
            {
              "url": "https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc"
            },
            {
              "url": "https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562"
            }
          ],
          "title": "net: bonding: fix use-after-free after 802.3ad slave unbind",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49667",
        "datePublished": "2025-02-26T02:24:01.818Z",
        "dateReserved": "2025-02-26T02:21:30.436Z",
        "dateUpdated": "2025-05-04T08:42:54.979Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.