Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-42328

CVE-2022-42328MEDIUM

Linux Linux — Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspect…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0022   12.1     —

AFFECTED
  Product  Versions     Fixed
  Linux    unspecified  —

TIMELINE
  Oct 3   Reserved by XEN
  Dec 7   Published (CNA: XEN)
  Oct 14  RESCORED — CVE-2022-42328 (Linux). CVSS 6.2 → 5.5 (NVD).

CWE-667 · CNA: XEN · CVSS v3.1 · 8 references · NVD status: Modified

Description

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 3, 2022	Reserved	Reserved by XEN
December 7, 2022	Published	Published (CNA: XEN)
October 14, 2026	RESCORED	RESCORED — CVE-2022-42328 (Linux). CVSS 6.2 → 5.5 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	—	—

Weaknesses

CWE-667

References (8)

http://www.openwall.com/lists/oss-security/2022/12/08/2 [Mailing List, Patch, Third Party Advisory]
http://www.openwall.com/lists/oss-security/2022/12/08/3 [Mailing List, Patch, Third Party Advisory]
http://www.openwall.com/lists/oss-security/2022/12/09/2 [Mailing List, Patch, Third Party Advisory]
https://cert-portal.siemens.com/productcert/html/ssa-625862.html
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html [Mailing List, Third Party Advisory]
https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html [Mailing List, Third Party Advisory]
https://xenbits.xenproject.org/xsa/advisory-424.txt [Third Party Advisory]

Authoritative record: CVE-2022-42328 at cve.org

Vendors: linux

Weaknesses: CWE-667

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-42328 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.