{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49048", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.242Z", "datePublished": "2025-02-26T01:54:24.115Z", "dateUpdated": "2026-08-05T08:53:35.698Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:35.698Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix panic when forwarding a pkt with no in6 dev\n\nkongweibin reported a kernel panic in ip6_forward() when input interface\nhas no in6 dev associated.\n\nThe following tc commands were used to reproduce this panic:\ntc qdisc del dev vxlan100 root\ntc qdisc add dev vxlan100 root netem corrupt 5%" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ip6_forward runs on the IPv6 forwarding path (ipv6_rcv → ip6_rcv_finish → dst_input → ip6_forward) for packets received from the network; on an IPv6 router/gateway this is reachable by a remote peer sending packets through the host.\nAC:L - With IPv6 forwarding enabled (the realistic worst-case deployment for this code) and an ingress interface lacking in6_dev—an expected case the function already uses __in6_dev_get_safely for—an attacker can deterministically hit the disable_policy dereference by sending forwardable IPv6 packets, with no race outside their control.\nPR:N - IP forwarding processes unauthenticated packet data with no capability check or session; a remote peer on a path through the router needs no local credentials.\nUI:N - Crafted packets are handled automatically in softirq receive/forward context; no victim user or admin action is required beyond the host already acting as an IPv6 forwarder.\nS:U - The NULL dereference and resulting oops stay within the same host kernel authority; there is no VM escape, IOMMU bypass, or other cross-boundary impact.\nC:N - This is a pure NULL pointer dereference of idev->cnf.disable_policy with no out-of-bounds read, UAF, or other disclosure primitive.\nI:N - The fault is a NULL pointer read with no write, memory corruption, or control-flow hijack primitive beyond the ensuing oops.\nA:H - Dereferencing NULL idev causes a kernel oops/panic in the forwarding path, which is high availability impact and can be retriggered by further packets." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/ip6_output.c" ], "versions": [ { "version": "bff0854e2f804f68d3e93d19e4580dbd69777e1d", "lessThan": "74b68f5249f16c5f7f675d0f604fa6ae20e3a151", "status": "affected", "versionType": "git" }, { "version": "7f4848229e91d508102b30396b8a1b710ac23637", "lessThan": "ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435", "status": "affected", "versionType": "git" }, { "version": "79ec7b5b2f4fe38e5c7459ed0bdff4ef3386ab63", "lessThan": "a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e", "status": "affected", "versionType": "git" }, { "version": "ccd27f05ae7b8ebc40af5b004e94517a919aa862", "lessThan": "adee01bbf6cb5b3e4ed08be8ff866aac90f13836", "status": "affected", "versionType": "git" }, { "version": "ccd27f05ae7b8ebc40af5b004e94517a919aa862", "lessThan": "e69fb3de87a8923e5931a272a38fa3cceb01da44", "status": "affected", "versionType": "git" }, { "version": "ccd27f05ae7b8ebc40af5b004e94517a919aa862", "lessThan": "e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0", "status": "affected", "versionType": "git" }, { "version": "350e10d217337480158b604bbf6601c50ed161c6", "status": "affected", "versionType": "git" }, { "version": "4.19.199", "lessThan": "4.19.239", "status": "affected", "versionType": "semver" }, { "version": "5.4.136", "lessThan": "5.4.190", "status": "affected", "versionType": "semver" }, { "version": "5.10.54", "lessThan": "5.10.112", "status": "affected", "versionType": "semver" }, { "version": "5.13.6", "lessThan": "5.14", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/ip6_output.c" ], "versions": [ { "version": "5.14", "status": "affected" }, { "version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.239", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.190", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.112", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.35", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.4", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.199", "versionEndExcluding": "4.19.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.136", "versionEndExcluding": "5.4.190" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.54", "versionEndExcluding": "5.10.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.17.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/74b68f5249f16c5f7f675d0f604fa6ae20e3a151" }, { "url": "https://git.kernel.org/stable/c/ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435" }, { "url": "https://git.kernel.org/stable/c/a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e" }, { "url": "https://git.kernel.org/stable/c/adee01bbf6cb5b3e4ed08be8ff866aac90f13836" }, { "url": "https://git.kernel.org/stable/c/e69fb3de87a8923e5931a272a38fa3cceb01da44" }, { "url": "https://git.kernel.org/stable/c/e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0" } ], "title": "ipv6: fix panic when forwarding a pkt with no in6 dev", "x_generator": { "engine": "bippy-1.2.0" } } } }