01 Record

CVE-2022-49048

ipv6: fix panic when forwarding a pkt with no in6 dev

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

ipv6: fix panic when forwarding a pkt with no in6 dev

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.69% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 52.6% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2025-02-26 01:54Z1 YR AGO
Last updated: 2026-10-15 21:21Z13 DAYS AGO
Reserved: 2025-02-26
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 7.5)
CNA CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 963c88e14b1d4f293feb28f2a953fa57dbb83c37fb7c34b20750a702e84c6a9f

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxbff0854e2f804f68d3e93d19e4580dbd69777e1d to < 74b68f5249f16c5f7f675d0f604fa6ae20e3a151, 7f4848229e91d508102b30396b8a1b710ac23637 to < ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435, 79ec7b5b2f4fe38e5c7459ed0bdff4ef3386ab63 to < a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e, ccd27f05ae7b8ebc40af5b004e94517a919aa862 to < adee01bbf6cb5b3e4ed08be8ff866aac90f13836, ccd27f05ae7b8ebc40af5b004e94517a919aa862 to < e69fb3de87a8923e5931a272a38fa3cceb01da44, ccd27f05ae7b8ebc40af5b004e94517a919aa862 to < e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0, 350e10d217337480158b604bbf6601c50ed161c6, 4.19.199 to < 4.19.239, 5.4.136 to < 5.4.190, 5.10.54 to < 5.10.112, 5.13.6 to < 5.14, 5.14—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/74b68f5249f16c5f7f675d0f604fa6ae20e3a151
git.kernel.orghttps://git.kernel.org/stable/c/ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435
git.kernel.orghttps://git.kernel.org/stable/c/a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e
git.kernel.orghttps://git.kernel.org/stable/c/adee01bbf6cb5b3e4ed08be8ff866aac90f13836
git.kernel.orghttps://git.kernel.org/stable/c/e69fb3de87a8923e5931a272a38fa3cceb01da44
git.kernel.orghttps://git.kernel.org/stable/c/e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0

07 Fixed in

Debian 12

linux
Fixed in 5.17.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 5.17.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 5.17.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.