PT-2025-8070 · Linux+3 · Linux Kernel+3

Syzbot · Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-49142

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b

Description A vulnerability has been identified in the Linux kernel, specifically in the skb unclone keeptruesize() function. The issue arises when the kernel fails to preserve the skb end offset() in skb unclone keeptruesize(), leading to a potential error in skb try coalesce(). This vulnerability was discovered by syzbot and is related to the kfence mechanism. The problem occurs when TCP shifts data after skb unclone keeptruesize() has been used, notably from tcp retrans try collapse(). To fix this issue, the skb unclone keeptruesize() function has been split into two parts: an inline function for the common case and an out-of-line function for the 'slow path'.

Recommendations For Linux kernel version 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b and earlier, update to a newer version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALSA-2025_16880

BDU:2026-03811

CVE-2022-49142

RHSA-2022:8267

RHSA-2022_8267

Affected Products

Astra Linux

Debian

Linux Kernel

Red Hat

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49142.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-49142 · Vendor Advisory
• https://git.kernel.org/stable/c/2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01 · Patch
• https://git.kernel.org/stable/c/a9a6d30264327d8ff7f23da33e7a77ffb793fa3f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49142 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49142 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03811 · Security Note
• https://ubuntu.com/security/CVE-2022-49142 · Vendor Advisory
• https://git.kernel.org/stable/c/23629b673b780d967b88a850b1518cf0f0ffc6aa · Patch
• https://osv.dev/vulnerability/CVE-2022-49142 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49142 · Security Note
• https://git.kernel.org/stable/c/a903e516f5df44b46d526b403d93e7be1a425538 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49142 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49142 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2025022607-CVE-2022-49142-b3b9@gregkh/T · Note