CVE-2022-49015
net: hsr: Fix potential use-after-free
HIGH
7.8
CVSS Score
Published: October 21, 2024 at 08:06 PM UTC
Updated: August 5, 2026 at 09:24 AM UTC
1 product affected across 1 vendorLinux Kernel
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.3%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
3.13 ≤ v < 4.14.3013.13 ≤ v < 4.19.2683.13 ≤ v < 4.9.3353.13 ≤ v < 5.10.1583.13 ≤ v < 5.15.823.13 ≤ v < 5.4.2263.13 ≤ v < 6.0.123.13 ≤ v < 6.14.10 ≤ v < 4.14.3014.15 ≤ v < 4.19.2684.20 ≤ v < 5.4.2265.11 ≤ v < 5.15.825.16 ≤ v < 6.0.125.5 ≤ v < 5.10.1586.1 rc16.1 rc26.1 rc36.1 rc46.1 rc56.1 rc66.1 rc7f421436a591d34fa5279b54a96ac07d70250cc8d
Vendor states this is fixed in 4b351609af4fdbc23f79ab2b12748f4403ea9af4 (fixed)
Vendor states this is fixed in 53a62c5efe91665f7a41fad0f888a96f94dc59eb (fixed)
Vendor states this is fixed in 7ca81a161e406834a1fdc405fc83a572bd14b8d9 (fixed)
Vendor states this is fixed in 7e177d32442b7ed08a9fa61b61724abc548cb248 (fixed)
Vendor states this is fixed in 8393ce5040803666bfa26a3a7bf41e44fab0ace9 (fixed)
Vendor states this is fixed in b35d899854d5d5d58eb7d7e7c0f61afc60d3a9e9 (fixed)
Vendor states this is fixed in dca370e575d9b6c983f5015e8dc035e23e219ee6 (fixed)
Vendor states this is fixed in f3add2b8cf620966de3ebfa07679ca12d33ec26f (fixed)
Vendor states this is fixed in 3.13 (unaffected)
Vendor states this is fixed in 4.14.301 (unaffected)
Vendor states this is fixed in 4.19.268 (unaffected)
Vendor states this is fixed in 4.9.335 (unaffected)
Vendor states this is fixed in 5.10.158 (unaffected)
Vendor states this is fixed in 5.15.82 (unaffected)
Vendor states this is fixed in 5.4.226 (unaffected)
Vendor states this is fixed in 6.0.12 (unaffected)
Vendor states this is fixed in 6.1 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/4b351609af4fdbc23f79ab2b12748f4403ea9af4
- https://git.kernel.org/stable/c/53a62c5efe91665f7a41fad0f888a96f94dc59eb
- https://git.kernel.org/stable/c/7ca81a161e406834a1fdc405fc83a572bd14b8d9
- https://git.kernel.org/stable/c/7e177d32442b7ed08a9fa61b61724abc548cb248
- https://git.kernel.org/stable/c/8393ce5040803666bfa26a3a7bf41e44fab0ace9
References (8)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4b351609af4fdbc23f79ab2b12748f4403ea9af4Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/53a62c5efe91665f7a41fad0f888a96f94dc59ebPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7ca81a161e406834a1fdc405fc83a572bd14b8d9Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7e177d32442b7ed08a9fa61b61724abc548cb248Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8393ce5040803666bfa26a3a7bf41e44fab0ace9Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b35d899854d5d5d58eb7d7e7c0f61afc60d3a9e9Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dca370e575d9b6c983f5015e8dc035e23e219ee6Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f3add2b8cf620966de3ebfa07679ca12d33ec26fSSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-416
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card