---
id: CVE-2022-50252
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  igb: Do not free q_vector unless new one was allocated

  Avoid potential use-after-free condition under memory pressure
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  igb: Do not free q_vector unless new one was allocated

  Avoid potential use-after-free condition under memory pressure. If the
  kzalloc() fails, q_vector will be freed b…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 4.9.337
  - 'linux_kernel >= 4.10, < 4.14.303'
  - 'linux_kernel >= 4.15, < 4.19.270'
  - 'linux_kernel >= 4.20, < 5.4.229'
  - 'linux_kernel >= 5.5, < 5.10.163'
  - 'linux_kernel >= 5.11, < 5.15.86'
  - 'linux_kernel >= 5.16, < 6.0.16'
  - 'linux_kernel >= 6.1, < 6.1.2'
patched:
  - linux_kernel 6.1.2
published: '2025-09-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:28.360'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50252'
references:
  - url: 'https://git.kernel.org/stable/c/0200f0fbb11e359cc35af72ab10b2ec224e6f633'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0668716506ca66f90d395f36ccdaebc3e0e84801'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/314f7092b27749bdde44c14095b5533afa2a3bc8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3cb18dea11196fb4a06f78294cec5e61985e1aff'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/56483aecf6b22eb7dff6315b3a174688c6ad494c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64ca1969599857143e91aeec4440640656100803'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/68e8adbcaf7a8743e473343b38b9dad66e2ac6f3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e399577bd397a517df4b938601108c63769ce0a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f96bd8adc8adde25390965a8c1ee81b73cb62075'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50252.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-50252'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2395344'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-50252'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50252'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025091550-CVE-2022-50252-5c96@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00166
epssPercentile: 0.05851
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:30:40.430388Z'
scores:
  nvd: 7.8
  vendor: 1.9
  cna: 7.8
ingestedAt: '2026-10-15T21:45:11.280Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

igb: Do not free q_vector unless new one was allocated

Avoid potential use-after-free condition under memory pressure. If the
kzalloc() fails, q_vector will be freed but left in the original
adapter->q_vector[v_idx] array position.

## Affected

- `linux_kernel < 4.9.337`
- `linux_kernel >= 4.10, < 4.14.303`
- `linux_kernel >= 4.15, < 4.19.270`
- `linux_kernel >= 4.20, < 5.4.229`
- `linux_kernel >= 5.5, < 5.10.163`
- `linux_kernel >= 5.11, < 5.15.86`
- `linux_kernel >= 5.16, < 6.0.16`
- `linux_kernel >= 6.1, < 6.1.2`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.1.2`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50252.json)