PT-2025-18562 · Linux+5 · Linux Kernel+5

Published 2025-05-01 · Updated 2025-11-12 · CVE-2022-49845

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A issue in the Linux kernel has been resolved, specifically in the j1939 module. The problem was related to the lack of initialization of the CAN header. The read access to canxl frame::len inside a skbuff created with j1939 revealed that reserved elements in can frame were not initialized before being filled. This has been fixed by initializing the 8-byte CAN header with zeros.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALSA-2025:20518

BDU:2026-05841

CVE-2022-49845

INFSA-2025_20518

RHSA-2025:20518

RHSA-2025_20518

SUSE-SU-2025:01918-1

SUSE-SU-2025:01966-1

SUSE-SU-2025:02173-1

SUSE-SU-2025:02262-1

SUSE-SU-2025:2173-1

SUSE-SU-2025_02173-1

SUSE-SU-2025_02262-1

Affected Products

Almalinux

Astra Linux

Linux Kernel

Red Hat

Rocky Linux

Suse

References · 678

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49845.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49845 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49845 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-20518.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49845 · Security Note
• https://bdu.fstec.ru/vul/2026-05841 · Security Note
• https://git.kernel.org/stable/c/69e86c6268d59ceddd0abe9ae8f1f5296f316c3c · Patch
• https://linux.oracle.com/errata/ELSA-2025-20518-0.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02173-1 · Vendor Advisory
• https://git.kernel.org/stable/c/f8e0edeaa0f2b860bdbbf0aafb4492533043d650 · Patch
• https://osv.dev/vulnerability/ALSA-2025:20518 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01966-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:20518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49845 · Vendor Advisory
• https://git.kernel.org/stable/c/2719f82ad5d8199cf5f346ea8bb3998ad5323b72 · Patch