CVE-2022-50636

Root

Cause

The pci_device_is_present() function in the Linux kernel failed to correctly detect Virtual Functions (VFs) because it reads the Vendor and Device ID registers, which return 0xffff for VFs (indicating 'not present'). This caused the function to always return false for VFs, even when the underlying Physical Function (PF) was present and operational [1].

Exploitation

Scenario

An attacker with the ability to trigger device removal—for example, by unbinding a driver or writing "0" to /sys/.../sriov_numvfs—could exploit this bug. When pci_device_is_present(VF) returns false during removal, the kernel calls virtio_break_device(), which breaks the virtqueues. This prevents the interrupt handler from completing pending I/O operations, leading to a hang in the block layer (e.g., blk_mq_freeze_queue_wait) [1].

Impact

The bug results in a denial-of-service condition: the system becomes unresponsive as processes (such as bash) enter an uninterruptible sleep state (D state) waiting for I/O to complete. The call trace shows a hang in virtblk_remove() and blk_cleanup_queue(), effectively freezing storage I/O for affected virtio devices [1].

Mitigation

The fix modifies pci_device_is_present() to always check the PF when called on a VF, using pci_physfn(). This ensures correct presence detection and prevents the spurious device break. The patch has been merged into the Linux kernel stable tree and is available in commits such commits as 99ef6cc79158, 518573988a2f, and 67fd41bbb0f5 [1][2][3]. Users should apply the latest stable kernel updates.