{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-49592", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-49592", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-02-26T02:23:24.552Z", "updatedAt": "2026-05-11T19:02:55.672Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "net: stmmac: fix dma queue left shift overflow issue", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix dma queue left shift overflow issue\n\nWhen queue number is > 4, left shift overflows due to 32 bits\ninteger variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1.\n\nIf CONFIG_UBSAN is enabled, kernel dumps below warning:\n[ 10.363842] ==================================================================\n[ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/\nlinux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12\n[ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int'\n[ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg\n[ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021\n[ 10.363958] Call Trace:\n[ 10.363960] \n[ 10.363963] dump_stack_lvl+0x4a/0x5f\n[ 10.363971] dump_stack+0x10/0x12\n[ 10.363974] ubsan_epilogue+0x9/0x45\n[ 10.363976] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e\n[ 10.363979] ? wake_up_klogd+0x4a/0x50\n[ 10.363983] ? vprintk_emit+0x8f/0x240\n[ 10.363986] dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac]\n[ 10.364001] stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac]\n[ 10.364009] ? dwmac410_dma_init_channel+0x70/0x70 [stmmac]\n[ 10.364020] stmmac_hw_setup.cold+0xf/0xb14 [stmmac]\n[ 10.364030] ? page_pool_alloc_pages+0x4d/0x70\n[ 10.364034] ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac]\n[ 10.364042] stmmac_open+0x39e/0x920 [stmmac]\n[ 10.364050] __dev_open+0xf0/0x1a0\n[ 10.364054] __dev_change_flags+0x188/0x1f0\n[ 10.364057] dev_change_flags+0x26/0x60\n[ 10.364059] do_setlink+0x908/0xc40\n[ 10.364062] ? do_setlink+0xb10/0xc40\n[ 10.364064] ? __nla_validate_parse+0x4c/0x1a0\n[ 10.364068] __rtnl_newlink+0x597/0xa10\n[ 10.364072] ? __nla_reserve+0x41/0x50\n[ 10.364074] ? __kmalloc_node_track_caller+0x1d0/0x4d0\n[ 10.364079] ? pskb_expand_head+0x75/0x310\n[ 10.364082] ? nla_reserve_64bit+0x21/0x40\n[ 10.364086] ? skb_free_head+0x65/0x80\n[ 10.364089] ? security_sock_rcv_skb+0x2c/0x50\n[ 10.364094] ? __cond_resched+0x19/0x30\n[ 10.364097] ? kmem_cache_alloc_trace+0x15a/0x420\n[ 10.364100] rtnl_newlink+0x49/0x70\n\nThis change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue\nmapping warning.\n\nBugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216195", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "ad2febdfbd01e1d092a08bfdba92ede79ea05ff3" }, { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "508d86ead36cbd8dfb60773a33276790d668c473" }, { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "573768dede0e2b7de38ecbc11cb3ee47643902dc" }, { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "a3ac79f38d354b10925824899cdbd2caadce55ba" }, { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "7c687a893f5cae5ca40d189635602e93af9bab73" }, { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "e846bde09677fa3b203057846620b7ed96540f5f" }, { "version": "d43042f4da3e1c2e4ccac3b1d9153cb0798533a4", "status": "affected", "versionType": "git", "lessThan": "613b065ca32e90209024ec4a6bb5ca887ee70980" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.12", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.12" }, { "version": "4.14.290", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.254", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.208", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.134", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.58", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "5.18.15", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.18.*" }, { "version": "5.19", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }