CVE-2022-49048ipv6: fix panic when forwarding a pkt with no in6 dev
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5%
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from bff0854e2f804f68d3e93d19e4580dbd69777e1d before 74b68f5249f16c5f7f675d0f604fa6ae20e3a151; from 7f4848229e91d508102b30396b8a1b710ac23637 before ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435; from 79ec7b5b2f4fe38e5c7459ed0bdff4ef3386ab63 before a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e; from ccd27f05ae7b8ebc40af5b004e94517a919aa862 before adee01bbf6cb5b3e4ed08be8ff866aac90f13836; from ccd27f05ae7b8ebc40af5b004e94517a919aa862 before e69fb3de87a8923e5931a272a38fa3cceb01da44; from ccd27f05ae7b8ebc40af5b004e94517a919aa862 before e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0; 350e10d217337480158b604bbf6601c50ed161c6; from 4.19.199 before 4.19.239; and 3 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 4.19.199 before 4.19.239; from 5.4.136 before 5.4.190; from 5.10.54 before 5.10.112; from 5.13.6 before 5.14; from 5.14.1 before 5.15.35; from 5.16 before 5.17.4; 5.14; 5.14; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/74b68f5249f16c5f7f675d0f604fa6ae20e3a151patch
- https://git.kernel.org/stable/c/ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435patch
- https://git.kernel.org/stable/c/a263712ba8c9ded25dd9d2d5ced11bcea5b33a3epatch
- https://git.kernel.org/stable/c/adee01bbf6cb5b3e4ed08be8ff866aac90f13836patch
- https://git.kernel.org/stable/c/e69fb3de87a8923e5931a272a38fa3cceb01da44patch
- https://git.kernel.org/stable/c/e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.