7.8

CVE-2022-49667: net: bonding: fix use-after-free after 802.3ad slave unbind

Analyzed
AliasesUBUNTU-CVE-2022-49667DEBIAN-CVE-2022-49667
Published 26-02-2025Last modified 05-08-2026

Vulnerability summary

CVE-2022-49667 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 5
RHSA-2026:1494RHSA-2026:1495SUSE-SU-2025:1027-1SUSE-SU-2025:1176-1SUSE-SU-2025:1183-1SUSE-SU-2025:1241-1

Timeline

  1. 26-02-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg(). The KASAN logs are as follows: [ 767.617392] ================================================================== [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu111 products
  • linuxAll versions (No fix recorded) | < 4.15.0-194.205 | < 5.4.0-128.144 | < 5.15.0-48.54
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1142.154 | < 5.4.0-1086.93 | < 5.15.0-1020.24
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < b90ac60303063a43e17dd4aec159067599d255e6 | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < f162f7c348fa2a5555bafdb5cc890b89b221e69c | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < 893825289ba840afd86bfffcb6f7f363c73efff8 | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < 63b2fe509f69b90168a75e04e14573dccf7984e6 | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < ef0af7d08d26c5333ff4944a559279464edf6f15 | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < 2765749def4765c5052a4c66445cf4c96fcccdbc | ≥ 0622cab0341cac6b30da177b0faa39fae0680e71, < 050133e1aa2cb49bb17be847d48a4431598ef562 | 4.7
  • linux_kernel≥ 4.7, < 4.9.322 | ≥ 4.10, < 4.14.287 | ≥ 4.15, < 4.19.251 | ≥ 4.20, < 5.4.204 | ≥ 5.5, < 5.10.129 | ≥ 5.11, < 5.15.53 | ≥ 5.16, < 5.18.10 | 5.19:rc1 | 5.19:rc2 | 5.19:rc3 | 5.19:rc4
Debian1 product
  • linux< 5.18.14-1

3 vendors · 114 products

References

12 links
Show all 12 references