Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2022-50054— iavf: Fix NULL pointer dereference in iavf_get_link_ksettings

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致系统崩溃。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.16% · P5 Updated May 13, 2026

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Linux	Linux	`209f2f9c718138ddbd8586e5a1463bd079a17241< b305c7e9363f5a174ee08ac5f056e4b209f0325b`	affected
		`209f2f9c718138ddbd8586e5a1463bd079a17241< 541a1af451b0cb3779e915d48d08efb17915207b`	affected
		`5.17`	affected
		`< 5.17`	unaffected
		`5.19.4≤ 5.19.*`	unaffected
		`6.0≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-50054

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

iavf: Fix NULL pointer dereference in iavf_get_link_ksettings

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix NULL pointer dereference in iavf_get_link_ksettings Fix possible NULL pointer dereference, due to freeing of adapter->vf_res in iavf_init_get_resources. Previous commit introduced a regression, where receiving IAVF_ERR_ADMIN_QUEUE_NO_WORK from iavf_get_vf_config would free adapter->vf_res. However, netdev is still registered, so ethtool_ops can be called. Calling iavf_get_link_ksettings with no vf_res, will result with: [ 9385.242676] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 9385.242683] #PF: supervisor read access in kernel mode [ 9385.242686] #PF: error_code(0x0000) - not-present page [ 9385.242690] PGD 0 P4D 0 [ 9385.242696] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [ 9385.242701] CPU: 6 PID: 3217 Comm: pmdalinux Kdump: loaded Tainted: G S E 5.18.0-04958-ga54ce3703613-dirty #1 [ 9385.242708] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.11.0 11/02/2019 [ 9385.242710] RIP: 0010:iavf_get_link_ksettings+0x29/0xd0 [iavf] [ 9385.242745] Code: 00 0f 1f 44 00 00 b8 01 ef ff ff 48 c7 46 30 00 00 00 00 48 c7 46 38 00 00 00 00 c6 46 0b 00 66 89 46 08 48 8b 87 68 0e 00 00 <f6> 40 08 80 75 50 8b 87 5c 0e 00 00 83 f8 08 74 7a 76 1d 83 f8 20 [ 9385.242749] RSP: 0018:ffffc0560ec7fbd0 EFLAGS: 00010246 [ 9385.242755] RAX: 0000000000000000 RBX: ffffc0560ec7fc08 RCX: 0000000000000000 [ 9385.242759] RDX: ffffffffc0ad4550 RSI: ffffc0560ec7fc08 RDI: ffffa0fc66674000 [ 9385.242762] RBP: 00007ffd1fb2bf50 R08: b6a2d54b892363ee R09: ffffa101dc14fb00 [ 9385.242765] R10: 0000000000000000 R11: 0000000000000004 R12: ffffa0fc66674000 [ 9385.242768] R13: 0000000000000000 R14: ffffa0fc66674000 R15: 00000000ffffffa1 [ 9385.242771] FS: 00007f93711a2980(0000) GS:ffffa0fad72c0000(0000) knlGS:0000000000000000 [ 9385.242775] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9385.242778] CR2: 0000000000000008 CR3: 0000000a8e61c003 CR4: 00000000003706e0 [ 9385.242781] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 9385.242784] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 9385.242787] Call Trace: [ 9385.242791] <TASK> [ 9385.242793] ethtool_get_settings+0x71/0x1a0 [ 9385.242814] __dev_ethtool+0x426/0x2f40 [ 9385.242823] ? slab_post_alloc_hook+0x4f/0x280 [ 9385.242836] ? kmem_cache_alloc_trace+0x15d/0x2f0 [ 9385.242841] ? dev_ethtool+0x59/0x170 [ 9385.242848] dev_ethtool+0xa7/0x170 [ 9385.242856] dev_ioctl+0xc3/0x520 [ 9385.242866] sock_do_ioctl+0xa0/0xe0 [ 9385.242877] sock_ioctl+0x22f/0x320 [ 9385.242885] __x64_sys_ioctl+0x84/0xc0 [ 9385.242896] do_syscall_64+0x3a/0x80 [ 9385.242904] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 9385.242918] RIP: 0033:0x7f93702396db [ 9385.242923] Code: 73 01 c3 48 8b 0d ad 57 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 57 38 00 f7 d8 64 89 01 48 [ 9385.242927] RSP: 002b:00007ffd1fb2bf18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 9385.242932] RAX: ffffffffffffffda RBX: 000055671b1d2fe0 RCX: 00007f93702396db [ 9385.242935] RDX: 00007ffd1fb2bf20 RSI: 0000000000008946 RDI: 0000000000000007 [ 9385.242937] RBP: 00007ffd1fb2bf20 R08: 0000000000000003 R09: 0030763066307330 [ 9385.242940] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd1fb2bf80 [ 9385.242942] R13: 0000000000000007 R14: 0000556719f6de90 R15: 00007ffd1fb2c1b0 [ 9385.242948] </TASK> [ 9385.242949] Modules linked in: iavf(E) xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nft_compat nf_nat_tftp nft_objref nf_conntrack_tftp bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables rfkill nfnetlink vfat fat irdma ib_uverbs ib_core intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretem ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于空指针取消引用，可能导致系统崩溃。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	209f2f9c718138ddbd8586e5a1463bd079a17241 ~ b305c7e9363f5a174ee08ac5f056e4b209f0325b	-
Linux	Linux	5.17	-

II. Public POCs for CVE-2022-50054

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2022-50054

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2022-50054

Same Patch Batch · Linux · 2025-06-18 · 362 CVEs total

CVE-2025-38075	9.8 CRITICAL	scsi: target: iscsi: Fix timeout on deleted connection
CVE-2022-50098	8.8 HIGH	scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
CVE-2025-38052	8.8 HIGH	net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
CVE-2022-49934	8.8 HIGH	wifi: mac80211: Fix UAF in ieee80211_scan_rx()
CVE-2022-50164	8.8 HIGH	wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
CVE-2025-38016	8.8 HIGH	HID: bpf: abort dispatch if device destroyed
CVE-2025-38074	8.8 HIGH	vhost-scsi: protect vq->log_used with vq->mutex
CVE-2022-49974	8.8 HIGH	HID: nintendo: fix rumble worker null pointer deref
CVE-2022-49968	8.0 HIGH	ieee802154/adf7242: defer destroy_workqueue call
CVE-2022-49939	7.8 HIGH	binder: fix UAF of ref->proc caused by race condition
CVE-2022-50022	7.8 HIGH	drivers:md:fix a potential use-after-free bug
CVE-2022-50028	7.8 HIGH	gadgetfs: ep_io - wait until IRQ finishes
CVE-2022-49935	7.8 HIGH	dma-buf/dma-resv: check if the new fence is really later
CVE-2025-38082	7.8 HIGH	gpio: virtuser: fix potential out-of-bound write
CVE-2022-50182	7.8 HIGH	media: imx-jpeg: Align upwards buffer size
CVE-2025-38080	7.8 HIGH	drm/amd/display: Increase block_sequence array size
CVE-2025-38079	7.8 HIGH	crypto: algif_hash - fix double free in hash_accept
CVE-2025-38060	7.8 HIGH	bpf: copy_verifier_state() should copy 'loop_entry' field
CVE-2025-38062	7.8 HIGH	genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
CVE-2022-50101	7.8 HIGH	video: fbdev: vt8623fb: Check the size of screen before memset_io()

Showing top 20 of 362 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2022-50054

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-50054— iavf: Fix NULL pointer dereference in iavf_get_link_ksettings

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 6

I. Basic Information for CVE-2022-50054

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2022-50054

III. Intelligence Information for CVE-2022-50054

Same Patch Batch · Linux · 2025-06-18 · 362 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2022-50054

Leave a comment