{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50483", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-04T15:13:33.468Z", "datePublished": "2025-10-04T15:16:41.703Z", "dateUpdated": "2026-08-05T08:58:54.379Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:58:54.379Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: avoid buffer leaks on xdp_do_redirect() failure\n\nBefore enetc_clean_rx_ring_xdp() calls xdp_do_redirect(), each software\nBD in the RX ring between index orig_i and i can have one of 2 refcount\nvalues on its page.\n\nWe are the owner of the current buffer that is being processed, so the\nrefcount will be at least 1.\n\nIf the current owner of the buffer at the diametrically opposed index\nin the RX ring (i.o.w, the other half of this page) has not yet called\nkfree(), this page's refcount could even be 2.\n\nenetc_page_reusable() in enetc_flip_rx_buff() tests for the page\nrefcount against 1, and [ if it's 2 ] does not attempt to reuse it.\n\nBut if enetc_flip_rx_buff() is put after the xdp_do_redirect() call,\nthe page refcount can have one of 3 values. It can also be 0, if there\nis no owner of the other page half, and xdp_do_redirect() for this\nbuffer ran so far that it triggered a flush of the devmap/cpumap bulk\nqueue, and the consumers of those bulk queues also freed the buffer,\nall by the time xdp_do_redirect() returns the execution back to enetc.\n\nThis is the reason why enetc_flip_rx_buff() is called before\nxdp_do_redirect(), but there is a big flaw with that reasoning:\nenetc_flip_rx_buff() will set rx_swbd->page = NULL on both sides of the\nenetc_page_reusable() branch, and if xdp_do_redirect() returns an error,\nwe call enetc_xdp_free(), which does not deal gracefully with that.\n\nIn fact, what happens is quite special. The page refcounts start as 1.\nenetc_flip_rx_buff() figures they're reusable, transfers these\nrx_swbd->page pointers to a different rx_swbd in enetc_reuse_page(), and\nbumps the refcount to 2. When xdp_do_redirect() later returns an error,\nwe call the no-op enetc_xdp_free(), but we still haven't lost the\nreference to that page. A copy of it is still at rx_ring->next_to_alloc,\nbut that has refcount 2 (and there are no concurrent owners of it in\nflight, to drop the refcount). What really kills the system is when\nwe'll flip the rx_swbd->page the second time around. With an updated\nrefcount of 2, the page will not be reusable and we'll really leak it.\nThen enetc_new_page() will have to allocate more pages, which will then\neventually leak again on further errors from xdp_do_redirect().\n\nThe problem, summarized, is that we zeroize rx_swbd->page before we're\ncompletely done with it, and this makes it impossible for the error path\nto do something with it.\n\nSince the packet is potentially multi-buffer and therefore the\nrx_swbd->page is potentially an array, manual passing of the old\npointers between enetc_flip_rx_buff() and enetc_xdp_free() is a bit\ndifficult.\n\nFor the sake of going with a simple solution, we accept the possibility\nof racing with xdp_do_redirect(), and we move the flip procedure to\nexecute only on the redirect success path. By racing, I mean that the\npage may be deemed as not reusable by enetc (having a refcount of 0),\nbut there will be no leak in that case, either.\n\nOnce we accept that, we have something better to do with buffers on\nXDP_REDIRECT failure. Since we haven't performed half-page flipping yet,\nwe won't, either (and this way, we can avoid enetc_xdp_free()\ncompletely, which gives the entire page to the slab allocator).\nInstead, we'll call enetc_xdp_drop(), which will recycle this half of\nthe buffer back to the RX ring." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug sits in enetc_clean_rx_ring_xdp() on the native NAPI RX path, so received Ethernet frames drive it. In a reasonable ENETC gateway/TSN deployment with an XDP_REDIRECT program already attached, a remote peer’s packets reach the vulnerable error path.\nAC:L - Once XDP_REDIRECT is active, the attacker can reliably force xdp_do_redirect() failures by flooding (devmap/cpumap enqueue/ENOMEM pressure) or against a down/invalid redirect target; no race or attacker-uncontrollable memory layout is required.\nPR:N - In the highest-impact scenario the administrator has already attached the XDP program; the attacker needs no host account or capability and only sends unauthenticated frames on the wire.\nUI:N - Packet reception and NAPI polling run automatically on the up interface; no separate victim mount, open, or interactive step is required.\nS:U - The leaked RX pages and resulting DoS remain inside the host kernel’s memory authority; there is no VM escape, IOMMU bypass, or other cross-boundary impact.\nC:N - This is a pure page reference leak after enetc_flip_rx_buff() nulls rx_swbd->page before a failed redirect; there is no OOB read, UAF reclaim, or other disclosure primitive.\nI:N - No out-of-bounds write, use-after-free, or type confusion occurs—only unreclaimed page references—so there is no integrity or code-execution primitive.\nA:H - Each failed redirect permanently leaks RX page(s), and sustained remote traffic can exhaust memory until the host is OOM/unavailable; the fix commit itself describes this progressive leak as killing the system, so availability is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/freescale/enetc/enetc.c" ], "versions": [ { "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6", "lessThan": "bcf2c1dc5358dcf7e34a68cdb6b0bbf967801efa", "status": "affected", "versionType": "git" }, { "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6", "lessThan": "7fba523b51ccce5f7981f8a43ad84d664da68131", "status": "affected", "versionType": "git" }, { "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6", "lessThan": "306526331e7a37e714e11ab7c6d73eb004745224", "status": "affected", "versionType": "git" }, { "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6", "lessThan": "628050ec952d2e2e46ec9fb6aa07e41139e030c8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/freescale/enetc/enetc.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.86", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.16", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.2", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.86" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.0.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/bcf2c1dc5358dcf7e34a68cdb6b0bbf967801efa" }, { "url": "https://git.kernel.org/stable/c/7fba523b51ccce5f7981f8a43ad84d664da68131" }, { "url": "https://git.kernel.org/stable/c/306526331e7a37e714e11ab7c6d73eb004745224" }, { "url": "https://git.kernel.org/stable/c/628050ec952d2e2e46ec9fb6aa07e41139e030c8" } ], "title": "net: enetc: avoid buffer leaks on xdp_do_redirect() failure", "x_generator": { "engine": "bippy-1.2.0" } } } }