medium 5.5

CVE-2022-48969 json

xen-netfront: Fix NULL sring after live migration

published 2024-10-21 2 y ago modified 2026-06-17 4 mo ago also EUVD-2022-53848

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260

finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]---

xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed

There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time

Patch / fix

fixed in 1 distros 4 links 6

Linux Linux 4.19.269, 5.4.227, 5.10.159, 5.15.83, 6.0.13, 6.1

debian ubuntu red hat suse

linux Debian 14, Debian 13, Debian 12 6.1.4-1

debian advisories DEBIAN-CVE-2022-48969

linux Ubuntu 20.04 LTS 5.4.0-144.161
linux Ubuntu 22.04 LTS 5.15.0-67.74
linux-aws Ubuntu 20.04 LTS 5.4.0-1097.105
linux-aws Ubuntu 22.04 LTS 5.15.0-1031.35
linux-gcp Ubuntu 20.04 LTS 5.4.0-1101.110
linux-gcp Ubuntu 22.04 LTS 5.15.0-1030.37
linux-gke Ubuntu 22.04 LTS 5.15.0-1028.33
linux-ibm Ubuntu 20.04 LTS 5.4.0-1045.50

ubuntu advisories UBUNTU-CVE-2022-48969

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-570.12.1.el9_6
rv RHEL 9 5.14.0-570.12.1.el9_6
perf RHEL 9 5.14.0-570.12.1.el9_6
rtla RHEL 9 5.14.0-570.12.1.el9_6
libperf RHEL 9 5.14.0-570.12.1.el9_6
kernel-rt RHEL 9 5.14.0-570.12.1.el9_6
kernel-64k RHEL 9 5.14.0-570.12.1.el9_6
kernel-core RHEL 9 5.14.0-570.12.1.el9_6

red hat advisories RHSA-2025:6966

kernel-64kb SLE Module for Basesystem 15 SP5 5.14.21-150500.55.88.1
kernel-syms SLE Module for Development Tools 15 SP5 5.14.21-150500.55.88.1
kernel-source SLE Module for Development Tools 15 SP5, SLE Module for Basesystem 15 SP5 5.14.21-150500.55.88.1
kernel-default SLE Module for Legacy 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +2 more 5.14.21-150500.55.88.1
kernel-zfcpdump SLE Module for Basesystem 15 SP5 5.14.21-150500.55.88.1
kernel-obs-build SLE Module for Development Tools 15 SP5 5.14.21-150500.55.88.1
kernel-default-base SLE Module for Basesystem 15 SP5, SLE Micro 5.5 5.14.21-150500.55.88.1.150500.6.39.4
kernel-64kb SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 5.14.21-150400.24.141.1

suse advisories SUSE-SU-2025:0034-1 SUSE-SU-2024:4364-1 SUSE-SU-2024:4131-1 SUSE-SU-2024:4100-1 SUSE-SU-2024:4082-1 SUSE-SU-2024:3985-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-48969 updated 2026-11-05 cvss 5.5

kernel: xen-netfront: Fix NULL sring after live migration

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.12.1.el9_6, perf 5.14.0-570.12.1.el9_6, rtla 5.14.0-570.12.1.el9_6, python3-perf 5.14.0-570.12.1.el9_6, kernel-devel-matched 5.14.0-570.12.1.el9_6, kernel-64k-devel-matched 5.14.0-570.12.1.el9_6, +7 more Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.12.1.el9_6, kernel-64k 5.14.0-570.12.1.el9_6, kernel-core 5.14.0-570.12.1.el9_6, kernel-tools 5.14.0-570.12.1.el9_6, kernel-modules 5.14.0-570.12.1.el9_6, kernel-64k-core 5.14.0-570.12.1.el9_6, +27 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.12.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.12.1.el9_6 Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.12.1.el9_6, kernel-rt-64k 5.14.0-570.12.1.el9_6, kernel-rt-core 5.14.0-570.12.1.el9_6, kernel-rt-modules 5.14.0-570.12.1.el9_6, kernel-rt-64k-core 5.14.0-570.12.1.el9_6, kernel-rt-debug-core 5.14.0-570.12.1.el9_6, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.12.1.el9_6, kernel-rt-kvm 5.14.0-570.12.1.el9_6, kernel-rt-core 5.14.0-570.12.1.el9_6, kernel-rt-modules 5.14.0-570.12.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.12.1.el9_6, kernel-rt-debug-core 5.14.0-570.12.1.el9_6, +6 more
fixed: vendor fix RHSA-2025:6966

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-22)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2022-48969
NVD CVE-2022-48969

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary