CVE-2022-49084

In the Linux kernel, the following vulnerability has been resolved:

qede: confirm skb is allocated before using

qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL.

Add a check in case build_skb() failed to allocate and return NULL.

The NULL return is handled correctly in callers to qede_build_skb().

This vulnerability is rated as Moderate severity because it requires systems to utilize specific QLogic FastLinQ ethernet hardware under low-memory conditions to trigger a denial of service. The issue cannot be exploited to compromise confidentiality or escalate privileges, restricting the blast radius strictly to system availability through a kernel crash. Systems lacking this specific network adapter hardware or using alternative network interface cards are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.