CVE-2022-49672

net: tun: unlink NAPI from device on destruction

MEDIUM

5.5

CVSS Score

Published: February 26, 2025 at 02:24 AM UTC

Updated: August 5, 2026 at 09:24 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: net: tun: unlink NAPI from device on destruction Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.15 ≤ v < 4.19.2514.15 ≤ v < 5.10.1294.15 ≤ v < 5.15.534.15 ≤ v < 5.18.104.15 ≤ v < 5.194.15 ≤ v < 5.4.2044.20 ≤ v < 5.4.2045.11 ≤ v < 5.15.535.16 ≤ v < 5.18.105.5 ≤ v < 5.10.1295.19 rc1 5.19 rc2 5.19 rc3 5.19 rc4943170998b200190f99d3fe7e771437e2c51f319

Vendor states this is fixed in 3b9bc84d311104906d2b4995a9a02d7b7ddab2db (fixed)

Vendor states this is fixed in 8145f77d38de4f88b8a69e1463f5c09ba189d77c (fixed)

Vendor states this is fixed in 82e729aee59acefe135fceffadcbc5b86dd4f1b9 (fixed)

Vendor states this is fixed in 8661d4b8faa2f7ee7a559969c0a7c57f077b1728 (fixed)

Vendor states this is fixed in a8cf919022373c97a84fe596bbea544f909c485d (fixed)

Vendor states this is fixed in bec1be0a745ab420718217e3e0d9542a75108989 (fixed)

Vendor states this is fixed in 4.15 (unaffected)

Vendor states this is fixed in 4.19.251 (unaffected)

Vendor states this is fixed in 5.10.129 (unaffected)

Vendor states this is fixed in 5.15.53 (unaffected)

Vendor states this is fixed in 5.18.10 (unaffected)

Vendor states this is fixed in 5.19 (unaffected)