{"id":"CVE-2022-49820","summary":"mctp i2c: don't count unused / invalid keys for flow release","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmctp i2c: don't count unused / invalid keys for flow release\n\nWe're currently hitting the WARN_ON in mctp_i2c_flow_release:\n\n    if (midev-\u003erelease_count \u003e midev-\u003ei2c_lock_count) {\n        WARN_ONCE(1, \"release count overflow\");\n\nThis may be hit if we expire a flow before sending the first packet it\ncontains - as we will not be pairing the increment of release_count\n(performed on flow release) with the i2c lock operation (only\nperformed on actual TX).\n\nTo fix this, only release a flow if we've encountered it previously (ie,\ndev_flow_state does not indicate NEW), as we will mark the flow as\nACTIVE at the same time as accounting for the i2c lock operation. We\nalso need to add an INVALID flow state, to indicate when we've done the\nrelease.","modified":"2026-03-20T11:47:16.040247Z","published":"2025-05-01T14:09:42.252Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49820.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/9cbd48d5fa14e4c65f8580de16686077f7cea02b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a5915a9a3ab4067ef8996a57738d156eabeb3a12"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49820.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49820"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f5b8abf9fc3dacd7529d363e26fe8230935d65f8"},{"fixed":"a5915a9a3ab4067ef8996a57738d156eabeb3a12"},{"fixed":"9cbd48d5fa14e4c65f8580de16686077f7cea02b"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49820.json"}}],"schema_version":"1.7.5"}