CVE-2022-49003 is a use-after-free vulnerability in the Linux kernel's NVMe driver, specifically affecting the nvme_ns_head list. This flaw arises because the nvme_mpath_revalidate_paths() function and namespace removal operations fail to properly synchronize with the head's SRCU lock, allowing concurrent scan work to free a namespace while it's still being accessed. This can lead to a kernel panic and system unavailability. The vulnerability has a CVSS score of 4.7 (Medium), indicating a local attack vector with high attack complexity and low privileges required, resulting in high impact to availability (A:H). There is no impact on confidentiality or integrity. Currently, there is no evidence of active exploitation, and no public exploit code or Metasploit modules are available. The vulnerability has received minimal community discussion and media coverage, suggesting low awareness or perceived threat at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.15, < 5.15.82CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.16, < 6.0.12CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.1CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* | ||
6.1CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* | ||
6.1CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.