CVE-2022-49581be2net: Fix buffer overflow in be_get_module_eeprom
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: be2net: Fix buffer overflow in be_get_module_eeprom be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from e36edd9d26cf257511548edaf2b7a56eb4fed854 before a5a8fc0679a8fd58d47aa2ebcfc5742631f753f9; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before fe4473fc7940f14c4a12db873b9729134c212654; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before 8ff4f9df73e5c551a72ee6034886c17e8de6596d; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before a8569f76df7ec5b4b51155c57523a0b356db5741; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before 665cbe91de2f7c97c51ca8fce39aae26477c1948; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before aba8ff847f4f927ad7a1a1ee4a9f29989a1a728f; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before 18043da94c023f3ef09c15017bdb04e8f695ef10; from e36edd9d26cf257511548edaf2b7a56eb4fed854 before d7241f679a59cfe27f92cb5c6272cb429fb1f7ec | CNA record |
linux linux_kernel linux:linux_kernel | from 3.18 before 4.9.325; from 4.10 before 4.14.290; from 4.15 before 4.19.254; from 4.20 before 5.4.208; from 5.5 before 5.10.134; from 5.11 before 5.15.58; from 5.16 before 5.18.15; 5.19; and 6 more ranges | NVD |
References
- https://git.kernel.org/stable/c/a5a8fc0679a8fd58d47aa2ebcfc5742631f753f9patch
- https://git.kernel.org/stable/c/fe4473fc7940f14c4a12db873b9729134c212654patch
- https://git.kernel.org/stable/c/8ff4f9df73e5c551a72ee6034886c17e8de6596dpatch
- https://git.kernel.org/stable/c/a8569f76df7ec5b4b51155c57523a0b356db5741patch
- https://git.kernel.org/stable/c/665cbe91de2f7c97c51ca8fce39aae26477c1948patch
- https://git.kernel.org/stable/c/aba8ff847f4f927ad7a1a1ee4a9f29989a1a728fpatch
- https://git.kernel.org/stable/c/18043da94c023f3ef09c15017bdb04e8f695ef10patch
- https://git.kernel.org/stable/c/d7241f679a59cfe27f92cb5c6272cb429fb1f7ecpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.