CVE-2022-49434

PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()

Published Feb 26, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()

The sysfs sriov_numvfs_store() path acquires the device lock before the
config space access lock:

sriov_numvfs_store
device_lock # A (1) acquire device lock
sriov_configure
vfio_pci_sriov_configure # (for example)
vfio_pci_core_sriov_configure
pci_disable_sriov
sriov_disable
pci_cfg_access_lock
pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0

Previously, pci_dev_lock() acquired the config space access lock before the
device lock:

pci_dev_lock
pci_cfg_access_lock
dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1
device_lock # A (3) wait for device lock

Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may
deadlock with sriov_numvfs_store() if the operations occur in the sequence
(1) (2) (3) (4).

Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires
the device lock before the config space access lock, the same as the
sriov_numvfs_store() path.

[bhelgaas: combined and adapted commit log from Jay Zhou's independent
subsequent posting:
https://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< aed6d4d519210c28817948f34c53b6e058e0456c
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< c9a81f9ed6ae3554621d6a50220b1bc74b67d81e
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< eff3587b9c01439b738298475e555c028ac9f55e
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< 2cdd5284035322795b0964f899eefba254cfe483
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< ea047f51172aa68841adef7f52d375002438b8f0
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< 59ea6b3ae51df7cd6bfd84c9c0030609b9315622
`17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e`	affected	< a91ee0e9fca9d7501286cfbced9b30a33e52740a

Linux

affected

Version	Status	Constraints
`4.13`	affected	—
`0`	unaffected	< 4.13
`4.14.283`	unaffected	≤ 4.14.*
`4.19.247`	unaffected	≤ 4.19.*
`5.4.198`	unaffected	≤ 5.4.*
`5.10.121`	unaffected	≤ 5.10.*
`5.15.46`	unaffected	≤ 5.15.*
`5.17.14`	unaffected	≤ 5.17.*
`5.18.3`	unaffected	≤ 5.18.*
`5.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-284.11.1.el9_2	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:2458	2023-05-09T00:00:00Z
kernel-0:5.14.0-284.11.1.el9_2	cpe:/o:redhat:enterprise_linux:9	RHSA-2023:2458	2023-05-09T00:00:00Z

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2022-54795	In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() The sysfs sriov_numvfs_store() path acquires the device lock before the config space access lock: sriov_numvfs_store device_lock # A (1) acquire device lock sriov_configure vfio_pci_sriov_configure # (for example) vfio_pci_core_sriov_configure pci_disable_sriov sriov_disable pci_cfg_access_lock pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0 Previously, pci_dev_lock() acquired the config space access lock before the device lock: pci_dev_lock pci_cfg_access_lock dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1 device_lock # A (3) wait for device lock Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may deadlock with sriov_numvfs_store() if the operations occur in the sequence (1) (2) (3) (4). Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires the device lock before the config space access lock, the same as the sriov_numvfs_store() path. [bhelgaas: combined and adapted commit log from Jay Zhou's independent subsequent posting: https://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.215% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2cdd5284035322795b0964f899eefba254cfe483
https://git.kernel.org/stable/c/59ea6b3ae51df7cd6bfd84c9c0030609b9315622
https://git.kernel.org/stable/c/a91ee0e9fca9d7501286cfbced9b30a33e52740a
https://git.kernel.org/stable/c/aed6d4d519210c28817948f34c53b6e058e0456c
https://git.kernel.org/stable/c/c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831
https://git.kernel.org/stable/c/c9a81f9ed6ae3554621d6a50220b1bc74b67d81e
https://git.kernel.org/stable/c/ea047f51172aa68841adef7f52d375002438b8f0
https://git.kernel.org/stable/c/eff3587b9c01439b738298475e555c028ac9f55e
https://lore.kernel.org/linux-cve-announce/2025022656-CVE-2022-49434-4a2c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49434
https://www.cve.org/CVERecord?id=CVE-2022-49434

History

Dec 23, 2025 2:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/da9792920ab525b8a932aa9aeee34529ad7b83f7

Oct 22, 2025 5:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Weaknesses		CWE-667
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.0018}`	epss `{'score': 0.00179}`

Jun 7, 2025 3:00 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Feb 27, 2025 1:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025022656-CVE-2022-49434-4a2c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2022-49434 https://www.cve.org/CVERecord?id=CVE-2022-49434
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Feb 26, 2025 2:45 AM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() The sysfs sriov_numvfs_store() path acquires the device lock before the config space access lock: sriov_numvfs_store device_lock # A (1) acquire device lock sriov_configure vfio_pci_sriov_configure # (for example) vfio_pci_core_sriov_configure pci_disable_sriov sriov_disable pci_cfg_access_lock pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0 Previously, pci_dev_lock() acquired the config space access lock before the device lock: pci_dev_lock pci_cfg_access_lock dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1 device_lock # A (3) wait for device lock Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may deadlock with sriov_numvfs_store() if the operations occur in the sequence (1) (2) (3) (4). Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires the device lock before the config space access lock, the same as the sriov_numvfs_store() path. [bhelgaas: combined and adapted commit log from Jay Zhou's independent subsequent posting: https://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]
Title		PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
References		https://git.kernel.org/stable/c/2cdd5284035322795b0964f899eefba254cfe483 https://git.kernel.org/stable/c/59ea6b3ae51df7cd6bfd84c9c0030609b9315622 https://git.kernel.org/stable/c/a91ee0e9fca9d7501286cfbced9b30a33e52740a https://git.kernel.org/stable/c/aed6d4d519210c28817948f34c53b6e058e0456c https://git.kernel.org/stable/c/c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831 https://git.kernel.org/stable/c/c9a81f9ed6ae3554621d6a50220b1bc74b67d81e https://git.kernel.org/stable/c/da9792920ab525b8a932aa9aeee34529ad7b83f7 https://git.kernel.org/stable/c/ea047f51172aa68841adef7f52d375002438b8f0 https://git.kernel.org/stable/c/eff3587b9c01439b738298475e555c028ac9f55e