LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49434: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()

In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() The sysfs sriov_numvfs_store() path acquires the device lock before the config space access lock: sriov_numvfs_store device_lock # A (1) acquire device lock sriov_configure vfio_pci_sriov_configure # (for example) vfio_pci_core_sriov_configure pci_disable_sriov sriov_disable pci_cfg_access_lock pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0 Previously, pci_dev_lock() acquired the config space access lock before the device lock: pci_dev_lock pci_cfg_access_lock dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1 device_lock # A (3) wait for device lock Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may deadlock with sriov_numvfs_store() if the operations occur in the sequence (1) (2) (3) (4). Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires the device lock before the config space access lock, the same as the sriov_numvfs_store() path. [bhelgaas: combined and adapted commit log from Jay Zhou's independent subsequent posting: https://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel availability bug in PCI SR-IOV handling. Under specific concurrent operations, the kernel can deadlock while changing virtual functions and performing PCI device-locking work. The sources do not show data theft, privilege escalation, or active exploitation.

Executive priority

Treat as a targeted availability risk for infrastructure hosts using SR-IOV or PCI passthrough. It should be patched through normal kernel maintenance, with higher priority for virtualization platforms where a host hang has business impact.

Technical view

The flaw is an AB/BA lock-order deadlock between sriov_numvfs_store(), which takes device_lock before pci_cfg_access_lock, and pci_dev_lock(), which previously took them in the reverse order. The fix changes pci_dev_lock() to acquire locks in the same order.

Likely exposure

Most relevant exposure is Linux systems using PCI SR-IOV, VFIO, or PCI function reset paths, especially virtualization or high-performance networking hosts. Exact exposure depends on kernel version and distribution backports.

Exploitation context

The provided sources mark KEV as false and contain no active exploitation claim. The described impact is a deadlock condition requiring overlapping SR-IOV configuration and PCI lock activity; practical exploitability is not established in the bundle.

Researcher notes

Evidence is limited to the CVE text and stable kernel commit references. No CVSS, CWE, exploit proof, or vendor-specific package matrix is included. The core issue is lock ordering, not memory corruption.

Mitigation direction

  • Apply a vendor kernel update containing the referenced stable commits.
  • Check Linux distribution advisories for backported fixes and affected package versions.
  • Prioritize hosts using SR-IOV, VFIO, or PCI passthrough.
  • Avoid relying on upstream version strings alone; validate distro patch status.

Validation and detection

  • Inventory Linux kernel versions across virtualization and SR-IOV-capable hosts.
  • Identify systems exposing or using sriov_numvfs configuration paths.
  • Confirm installed kernels include vendor fixes or equivalent stable commits.
  • Review operational logs for unexplained PCI or SR-IOV hangs.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49434 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8e, 17530e71e0166a37f8e20a9b7bcf1d50ae3cff8eunaffected
LinuxLinux4.13, 0, 4.14.283, 4.19.247, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.