# CVE-2022-49667: linux: In the Linux kernel, the following vulnerability has been resolved:  net: bonding: fix use-after-free after 802.3ad s...

CVE-2022-49667 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49667, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-49667
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0029
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 26, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: bonding: fix use-after-free after 802.3ad slave unbind  commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So, here we got slave ports, pointing to freed aggregator memory.  Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg().  The KASAN logs are as follows:  [  767.617392] ================================================================== [  767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 [  767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 [  767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G           O 5.15.11 #15 [  767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [  767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [  767.666468] Call trace: [  767.668930]  dump_backtrace+0x0/0x2d0 [  767.672625]  show_stack+0x24/0x30 [  767.675965]  dump_stack_lvl+0x68/0x84 [  767.679659]  print_address_description.constprop.0+0x74/0x2b8 [  767.685451]  kasan_report+0x1f0/0x260 [  767.689148]  __asan_load2+0x94/0xd0 [  767.692667]  bond_3ad_state_machine_handler+0x13dc/0x1470

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.18.14-1 | [DEBIAN-CVE-2022-49667](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49667.md) | Feb 26, 2025 |
| Linux | linux Debian 13.5 (trixie) | 5.18.14-1 | [DEBIAN-CVE-2022-49667](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49667.md) | Feb 26, 2025 |
| Linux | linux Debian 14 | 5.18.14-1 | [DEBIAN-CVE-2022-49667](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49667.md) | Feb 26, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.