CVE-2022-49958

net/sched: fix netdevice reference leaks in attach_default_qdiscs()

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix netdevice reference leaks in attach_default_qdiscs()

In attach_default_qdiscs(), if a dev has multiple queues and queue 0 fails

to attach qdisc because there is no memory in attach_one_default_qdisc().

Then dev->qdisc will be noop_qdisc by default. But the other queues may be

able to successfully attach to default qdisc.

In this case, the fallback to noqueue process will be triggered. If the

original attached qdisc is not released and a new one is directly

attached, this will cause netdevice reference leaks.

The following is the bug log:

veth0: default qdisc (fq_codel) fail, fallback to noqueue

unregister_netdevice: waiting for veth0 to become free. Usage count = 32

leaked reference.

qdisc_alloc+0x12e/0x210

qdisc_create_dflt+0x62/0x140

attach_one_default_qdisc.constprop.41+0x44/0x70

dev_activate+0x128/0x290

__dev_open+0x12a/0x190

__dev_change_flags+0x1a2/0x1f0

dev_change_flags+0x23/0x60

do_setlink+0x332/0x1150

__rtnl_newlink+0x52f/0x8e0

rtnl_newlink+0x43/0x70

rtnetlink_rcv_msg+0x140/0x3b0

netlink_rcv_skb+0x50/0x100

netlink_unicast+0x1bb/0x290

netlink_sendmsg+0x37c/0x4e0

sock_sendmsg+0x5f/0x70

____sys_sendmsg+0x208/0x280

Fix this bug by clearing any non-noop qdiscs that may have been assigned

before trying to re-attach.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Published
2025-06-18T11:00Z
EPSS history
Timeline
  • 18 JUN 11:00Z
    net/sched: fix netdevice reference leaks in attach_default_qdiscs()
    cvelistv5