CVE-2022-49584 – A race condition in the Linux kernel's ixgbe dr... (How to Fix)

Q: What is the severity of CVE-2022-49584?

CVE-2022-49584 has a CVSS score of 5.5 (MEDIUM). A race condition in the Linux kernel's ixgbe driver allows a kernel panic when disabling SR-IOV virtual functions while the physical function driver is processing VF requests. This affects systems using Intel 10GbE network adapters with SR-IOV enabled, primarily in virtualization environments.

📋 TL;DR

A race condition in the Linux kernel's ixgbe driver allows a kernel panic when disabling SR-IOV virtual functions while the physical function driver is processing VF requests. This affects systems using Intel 10GbE network adapters with SR-IOV enabled, primarily in virtualization environments.

💻 Affected Systems

Products:

Linux kernel with ixgbe driver

Versions: Kernel versions before fixes in stable releases (specific commits listed in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when SR-IOV is enabled and VFs are configured. Requires Intel 10GbE network hardware.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting all services on the affected host.

🟠

Likely Case

System crash requiring reboot when SR-IOV configuration is changed during active VF communication.

🟢

If Mitigated

No impact if SR-IOV is not used or if VF configuration changes are coordinated during maintenance windows.

🌐 Internet-Facing: LOW - Requires local access to modify SR-IOV settings, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Malicious local users or misconfigured automation could trigger the panic, affecting host stability.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Reproduction script provided in CVE description. Requires local access to modify sysfs SR-IOV settings.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 031af9e617a6f51075d97e56fc9e712c7dde2508, 16f929a5e76fd047fd8697e1e568bdd7d771955c, 1e53834ce541d4fe271cdcca7703e50be0a44f8a, 9d925d2dc82cec2bcbd8625457645d8a548ab22e, b82de63f8f817b5735480293dda8e92ba8170c52

Vendor Advisory: https://git.kernel.org/stable/c/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable SR-IOV

linux

Prevent use of SR-IOV functionality on affected network interfaces

echo 0 > /sys/class/net/<devname>/device/sriov_numvfs

Coordinate VF changes

linux

Ensure no VF communication occurs when changing SR-IOV configuration

🧯 If You Can't Patch

Restrict access to SR-IOV sysfs controls to privileged users only
Monitor for repeated SR-IOV configuration changes that could trigger the condition

🔍 How to Verify

Check if Vulnerable:

Check if system has Intel 10GbE NICs with SR-IOV enabled and kernel version is unpatched

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or is newer than patched releases

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning ixgbe_msg_task
System crash/reboot events after SR-IOV configuration changes

Network Indicators:

Sudden loss of network connectivity on affected interfaces

SIEM Query:

search 'kernel panic' AND 'ixgbe' OR 'sriov_numvfs' in system logs

📊 Metadata

CVE ID: CVE-2022-49584

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

EPSS Score: 0.03% exploit probability (7.1th percentile)

Published: February 26, 2025

Last Updated: October 22, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49584, you might also want to check these: