CVE-2022-48790

In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp. The race condition may happen in the following scenario: 1. driver executes its reset_ctrl_work 2. -> nvme_stop_ctrl - flushes ctrl async_event_work 3. ctrl sends AEN which is received by the host, which in turn schedules AEN handling 4. teardown admin queue (which releases the queue socket) 5. AEN processed, submits another AER, calling the driver to submit 6. driver attempts to send the cmd ==> use-after-free In order to fix that, add ctrl state check to validate the ctrl is actually able to accept the AER submission. This addresses the above race in controller resets because the driver during teardown should: 1. change ctrl state to RESETTING 2. flush async_event_work (as well as other async work elements) So after 1,2, any other AER command will find the ctrl state to be RESETTING and bail out without submitting the AER.

• CWE-416

• https://git.kernel.org/stable/c/0ead57ceb21bbf15963b4874c2ac67143455382fPatch
• https://git.kernel.org/stable/c/0fa0f99fc84e41057cbdd2efbfe91c6b2f47dd9dPatch
• https://git.kernel.org/stable/c/70356b756a58704e5c8818cb09da5854af87e765Patch
• https://git.kernel.org/stable/c/9e956a2596ae276124ef0d96829c013dd0faf861Patch
• https://git.kernel.org/stable/c/a25e460fbb0340488d119fb2e28fe3f829b7417ePatch
• https://git.kernel.org/stable/c/e043fb5a0336ee74614e26f0d9f36f1f5bb6d606Patch
• https://git.kernel.org/stable/c/0ead57ceb21bbf15963b4874c2ac67143455382fPatch
• https://git.kernel.org/stable/c/0fa0f99fc84e41057cbdd2efbfe91c6b2f47dd9dPatch
• https://git.kernel.org/stable/c/70356b756a58704e5c8818cb09da5854af87e765Patch
• https://git.kernel.org/stable/c/9e956a2596ae276124ef0d96829c013dd0faf861Patch
• https://git.kernel.org/stable/c/a25e460fbb0340488d119fb2e28fe3f829b7417ePatch
• https://git.kernel.org/stable/c/e043fb5a0336ee74614e26f0d9f36f1f5bb6d606Patch

Published

Jul 16, 2024

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-48785In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-48786In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-48787In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-48788In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-48789In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-4879A vulnerability was found in Forged Alliance Forever up to 3…7.5
• CVE-2022-48791In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-48792In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-48793In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-48794In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-48795In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-48796In the Linux kernel, the following vulnerability has been re…7.8