CVE-2022-49691

erspan: do not assume transport header is always set

MEDIUM

5.5

CVSS Score

Published: February 26, 2025 at 02:24 AM UTC

Updated: June 17, 2026 at 05:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: erspan: do not assume transport header is always set Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set. syzbot reported: WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Modules linked in: CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604 sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3815 [inline] __dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219 dev_queue_xmit include/linux/netdevice.h:2994 [inline] tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK>

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.18 ≤ v < 4.19.2504.18 ≤ v < 5.10.1274.18 ≤ v < 5.15.514.18 ≤ v < 5.18.84.18 ≤ v < 5.194.18 ≤ v < 5.4.2024.20 ≤ v < 5.4.2025.11 ≤ v < 5.15.515.16 ≤ v < 5.18.85.5 ≤ v < 5.10.1274.18 5.19 rc1 5.19 rc2 5.19 rc3d5db21a3e6977dcb42cee3d16cd69901fa66510a

Vendor states this is fixed in 02da602bc2f353dccd9e489a604490034ded941e (fixed)

Vendor states this is fixed in 2c8aeffc7c586d53e1d380f010bdca4f710f2480 (fixed)

Vendor states this is fixed in 301bd140ed0b24f0da660874c7e8a47dad8c8222 (fixed)

Vendor states this is fixed in a3b2470399f679587c45abe56e551caf10becca2 (fixed)

Vendor states this is fixed in cec9867ee55478ef5dcb2adf030fe0c442a4c4ee (fixed)

Vendor states this is fixed in fb401f37f6eadf24956d93687e5758c163c0d12b (fixed)

Vendor states this is fixed in 4.18 (unaffected)

Vendor states this is fixed in 4.19.250 (unaffected)

Vendor states this is fixed in 5.10.127 (unaffected)

Vendor states this is fixed in 5.15.51 (unaffected)

Vendor states this is fixed in 5.18.8 (unaffected)

Vendor states this is fixed in 5.19 (unaffected)