{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cedd4f01f67be94735f15123158f485028571037",
              "status": "affected",
              "version": "fd978bf7fd312581a7ca454a991f0ffb34c4204b",
              "versionType": "git"
            },
            {
              "lessThan": "466ce46f251dfb259a8cbaa895ab9edd6fb56240",
              "status": "affected",
              "version": "fd978bf7fd312581a7ca454a991f0ffb34c4204b",
              "versionType": "git"
            },
            {
              "lessThan": "ae5ccad6c711db0f2ca1231be051935dd128b8f5",
              "status": "affected",
              "version": "fd978bf7fd312581a7ca454a991f0ffb34c4204b",
              "versionType": "git"
            },
            {
              "lessThan": "f1db20814af532f85e091231223e5e4818e8464b",
              "status": "affected",
              "version": "fd978bf7fd312581a7ca454a991f0ffb34c4204b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix wrong reg type conversion in release_reference()\n\nSome helper functions will allocate memory. To avoid memory leaks, the\nverifier requires the eBPF program to release these memories by calling\nthe corresponding helper functions.\n\nWhen a resource is released, all pointer registers corresponding to the\nresource should be invalidated. The verifier use release_references() to\ndo this job, by apply  __mark_reg_unknown() to each relevant register.\n\nIt will give these registers the type of SCALAR_VALUE. A register that\nwill contain a pointer value at runtime, but of type SCALAR_VALUE, which\nmay allow the unprivileged user to get a kernel pointer by storing this\nregister into a map.\n\nUsing __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this\nproblem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-01T14:10:23.128Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cedd4f01f67be94735f15123158f485028571037"
        },
        {
          "url": "https://git.kernel.org/stable/c/466ce46f251dfb259a8cbaa895ab9edd6fb56240"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae5ccad6c711db0f2ca1231be051935dd128b8f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1db20814af532f85e091231223e5e4818e8464b"
        }
      ],
      "title": "bpf: Fix wrong reg type conversion in release_reference()",
      "x_generator": {
        "engine": "bippy-1.1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49873",
    "datePublished": "2025-05-01T14:10:23.128Z",
    "dateReserved": "2025-05-01T14:05:17.238Z",
    "dateUpdated": "2025-05-01T14:10:23.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49873\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:12.240\",\"lastModified\":\"2025-05-01T15:16:12.240\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix wrong reg type conversion in release_reference()\\n\\nSome helper functions will allocate memory. To avoid memory leaks, the\\nverifier requires the eBPF program to release these memories by calling\\nthe corresponding helper functions.\\n\\nWhen a resource is released, all pointer registers corresponding to the\\nresource should be invalidated. The verifier use release_references() to\\ndo this job, by apply  __mark_reg_unknown() to each relevant register.\\n\\nIt will give these registers the type of SCALAR_VALUE. A register that\\nwill contain a pointer value at runtime, but of type SCALAR_VALUE, which\\nmay allow the unprivileged user to get a kernel pointer by storing this\\nregister into a map.\\n\\nUsing __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this\\nproblem.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/466ce46f251dfb259a8cbaa895ab9edd6fb56240\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae5ccad6c711db0f2ca1231be051935dd128b8f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cedd4f01f67be94735f15123158f485028571037\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1db20814af532f85e091231223e5e4818e8464b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}