PT-2025-18573 · Linux · Linux Kernel

Published 2025-05-01 · Updated 2025-05-02 · CVE-2022-49856

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc3-syzkaller-00175-g1118b2049d77

Description A vulnerability has been resolved in the Linux kernel. The issue is related to the napi schedule prep() function, which must be called to ensure ownership of a napi before feeding packets to GRO and calling napi complete(). A recent patch exposed another issue in napi get frags() caught by syzbot. The vulnerability is related to the tun module and the napi complete done() function.

Recommendations To resolve the issue, update to a version of the Linux kernel that includes the fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-49856

Affected Products

Linux Kernel

References · 14

• https://osv.dev/vulnerability/CVE-2022-49856 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49856 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49856 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49856 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49856 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49856 · Vendor Advisory
• https://git.kernel.org/stable/c/534762e261c84d43e5d56a780e40278b94c20540 · Note
• https://git.kernel.org/stable/c/30b0263d0366ea63aa7cad0407dfd945cc348580 · Note
• https://git.kernel.org/stable/c/07d120aa33cc9d9115753d159f64d20c94458781 · Note
• https://git.kernel.org/stable/c/999550c8cbb3fcb535f542d652fe1cb936839e5f · Note
• https://git.kernel.org/stable/c/9132fa043f96ac545254ab326db5c6fd47d54acb · Note
• https://twitter.com/CVEnew/status/1917950865891287544 · Twitter Post
• https://git.kernel.org/linus/07d120aa33cc9d9115753d159f64d20c94458781 · Note
• https://git.kernel.org/stable/c/310f0855352ee4b2eb38855c99185c23e6e1496b · Note