CVE-2022-49820

mctp i2c: don't count unused / invalid keys for flow release

published May 1, 2025

CVSS
—
EPSS
0%
Percentile
6.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mctp i2c: don't count unused / invalid keys for flow release

We're currently hitting the WARN_ON in mctp_i2c_flow_release:

if (midev->release_count > midev->i2c_lock_count) {

WARN_ONCE(1, "release count overflow");

This may be hit if we expire a flow before sending the first packet it

contains - as we will not be pairing the increment of release_count

(performed on flow release) with the i2c lock operation (only

performed on actual TX).

To fix this, only release a flow if we've encountered it previously (ie,

dev_flow_state does not indicate NEW), as we will mark the flow as

ACTIVE at the same time as accounting for the i2c lock operation. We

also need to add an INVALID flow state, to indicate when we've done the

release.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.1th percentile
Published
2025-05-01T14:09Z
EPSS history
Timeline
  • 01 MAY 14:09Z
    mctp i2c: don't count unused / invalid keys for flow release
    cvelistv5