Linux Kernel up to 5.17.2 qede_build_skb denial of service

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.17.2. It has been classified as critical. This affects the function qede_build_skb. Performing a manipulation results in denial of service. This vulnerability was named CVE-2022-49084. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.17.2. It has been classified as critical. This affects the function qede_build_skb. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: qede: confirm skb is allocated before using qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL. Add a check in case build_skb() failed to allocate and return NULL. The NULL return is handled correctly in callers to qede_build_skb().

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2022-49084 since 02/26/2025. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 234545 (SUSE SLES12 Security Update : kernel (SUSE-SU-2025:1293-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.19.238, 5.4.189, 5.10.111, 5.15.34, 5.16.20 or 5.17.3 eliminates this vulnerability. Applying the patch 9648adb1b3ece55c657d3a4f52bfee663b710dfe/034a92c6a81048128fc7b18d278d52438a13902a/8928239e5e2e460d95b8a0b89f61671625e7ece0/c9bdce2359b5f4986eb38d1e81865b3586cc20d2/b2d6b3db9d1cf80908964036dbe1c52a86b1afb1/e1fd0c42acfa22bb34d2ab6a111484f466ab8093/4e910dbe36508654a896d5735b318c0b88172570 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (234545) and EUVD (EUVD-2022-55120). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.19.237
• 5.4.188
• 5.10.110
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9
• 5.16.10
• 5.16.11
• 5.16.12
• 5.16.13
• 5.16.14
• 5.16.15
• 5.16.16
• 5.16.17
• 5.16.18
• 5.16.19
• 5.17.0
• 5.17.1
• 5.17.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion