CVE-2022-49434: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
In the Linux kernel, the following vulnerability has been resolved:
PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
The sysfs sriov_numvfs_store() path acquires the device lock before the
config space access lock:
sriov_numvfs_store
device_lock # A (1) acquire device lock
sriov_configure
vfio_pci_sriov_configure # (for example)
vfio_pci_core_sriov_configure
pci_disable_sriov
sriov_disable
pci_cfg_access_lock
pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0
Previously, pci_dev_lock() acquired the config space access lock before the
device lock:
pci_dev_lock
pci_cfg_access_lock
dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1
device_lock # A (3) wait for device lock
Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may
deadlock with sriov_numvfs_store() if the operations occur in the sequence
(1) (2) (3) (4).
Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires
the device lock before the config space access lock, the same as the
sriov_numvfs_store() path.
[bhelgaas: combined and adapted commit log from Jay Zhou's independent
subsequent posting:
https://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability bug in PCI SR-IOV handling. Under specific concurrent operations, the kernel can deadlock while changing virtual functions and performing PCI device-locking work. The sources do not show data theft, privilege escalation, or active exploitation.
Executive priority
Treat as a targeted availability risk for infrastructure hosts using SR-IOV or PCI passthrough. It should be patched through normal kernel maintenance, with higher priority for virtualization platforms where a host hang has business impact.
Technical view
The flaw is an AB/BA lock-order deadlock between sriov_numvfs_store(), which takes device_lock before pci_cfg_access_lock, and pci_dev_lock(), which previously took them in the reverse order. The fix changes pci_dev_lock() to acquire locks in the same order.
Likely exposure
Most relevant exposure is Linux systems using PCI SR-IOV, VFIO, or PCI function reset paths, especially virtualization or high-performance networking hosts. Exact exposure depends on kernel version and distribution backports.
Exploitation context
The provided sources mark KEV as false and contain no active exploitation claim. The described impact is a deadlock condition requiring overlapping SR-IOV configuration and PCI lock activity; practical exploitability is not established in the bundle.
Researcher notes
Evidence is limited to the CVE text and stable kernel commit references. No CVSS, CWE, exploit proof, or vendor-specific package matrix is included. The core issue is lock ordering, not memory corruption.
Mitigation direction
Apply a vendor kernel update containing the referenced stable commits.
Check Linux distribution advisories for backported fixes and affected package versions.
Prioritize hosts using SR-IOV, VFIO, or PCI passthrough.
Avoid relying on upstream version strings alone; validate distro patch status.
Validation and detection
Inventory Linux kernel versions across virtualization and SR-IOV-capable hosts.
Identify systems exposing or using sriov_numvfs configuration paths.
Confirm installed kernels include vendor fixes or equivalent stable commits.
Review operational logs for unexplained PCI or SR-IOV hangs.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-49434 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Feb 26, 2025, 02:12 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.