boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-49858MEDIUM
Linux Linux — octeontx2-pf: Fix SQE threshold checking
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0017    6.6     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    3ca6c4c882a7f34085b170d93cf0d0e843aa00e6 –  —
  Linux    5.6 –                                       6.0.9
TIMELINE
  May 1   Reserved by Linux
  May 1   Published (CNA: Linux)
  Aug 4   RESCORED — CVE-2022-49858 (Linux). CVSS 7.8 → 5.5 (NVD).
CNA: Linux · CVSS v3.1 · 2 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same index is processed in NAPI resulting losing SKB pointers, hence a leak. Fix this by checking a consumer index which is updated once CQE is processed.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
May 1, 2025ReservedReserved by Linux
May 1, 2025PublishedPublished (CNA: Linux)
August 4, 2026RESCOREDRESCORED — CVE-2022-49858 (Linux). CVSS 7.8 → 5.5 (NVD).

Affected

Affected products and packages — 2 rows
VendorProduct / PackageEcosystemVersion introducedFixed
LinuxLinux3ca6c4c882a7f34085b170d93cf0d0e843aa00e6
LinuxLinux5.66.0.9

References (2)

Related

Authoritative record: CVE-2022-49858 at cve.org

Vendors: linux

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-49858 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.