{"id":"CVE-2022-49667","summary":"net: bonding: fix use-after-free after 802.3ad slave unbind","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free after 802.3ad slave unbind\n\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\"),\nresolve case, when there is several aggregation groups in the same bond.\nbond_3ad_unbind_slave will invalidate (clear) aggregator when\n__agg_active_ports return zero. So, ad_clear_agg can be executed even, when\nnum_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for,\npreviously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave\nwill not update slave ports list, because lag_ports==NULL. So, here we\ngot slave ports, pointing to freed aggregator memory.\n\nFix with checking actual number of ports in group (as was before\ncommit 0622cab0341c (\"bonding: fix 802.3ad aggregator reselection\") ),\nbefore ad_clear_agg().\n\nThe KASAN logs are as follows:\n\n[  767.617392] ==================================================================\n[  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470\n[  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767\n[  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15\n[  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT)\n[  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler\n[  767.666468] Call trace:\n[  767.668930]  dump_backtrace+0x0/0x2d0\n[  767.672625]  show_stack+0x24/0x30\n[  767.675965]  dump_stack_lvl+0x68/0x84\n[  767.679659]  print_address_description.constprop.0+0x74/0x2b8\n[  767.685451]  kasan_report+0x1f0/0x260\n[  767.689148]  __asan_load2+0x94/0xd0\n[  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470","modified":"2026-03-20T12:22:28.856863Z","published":"2025-02-26T02:24:01.818Z","related":["SUSE-SU-2025:1027-1","SUSE-SU-2025:1176-1","SUSE-SU-2025:1183-1","SUSE-SU-2025:1241-1","SUSE-SU-2025:1293-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49667.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/050133e1aa2cb49bb17be847d48a4431598ef562"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2765749def4765c5052a4c66445cf4c96fcccdbc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/63b2fe509f69b90168a75e04e14573dccf7984e6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/893825289ba840afd86bfffcb6f7f363c73efff8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b90ac60303063a43e17dd4aec159067599d255e6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ef0af7d08d26c5333ff4944a559279464edf6f15"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f162f7c348fa2a5555bafdb5cc890b89b221e69c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49667.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49667"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0622cab0341cac6b30da177b0faa39fae0680e71"},{"fixed":"a853b7a3a9fd1d74a4ccdd9cd73512b7dace2f1e"},{"fixed":"b90ac60303063a43e17dd4aec159067599d255e6"},{"fixed":"f162f7c348fa2a5555bafdb5cc890b89b221e69c"},{"fixed":"893825289ba840afd86bfffcb6f7f363c73efff8"},{"fixed":"63b2fe509f69b90168a75e04e14573dccf7984e6"},{"fixed":"ef0af7d08d26c5333ff4944a559279464edf6f15"},{"fixed":"2765749def4765c5052a4c66445cf4c96fcccdbc"},{"fixed":"050133e1aa2cb49bb17be847d48a4431598ef562"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49667.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}