CVE-2022-49727

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

MEDIUM

5.5

CVSS Score

Published: February 26, 2025 at 02:24 AM UTC

Updated: June 17, 2026 at 05:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 4.9.3203.5 ≤ v < 4.14.2853.5 ≤ v < 4.19.2493.5 ≤ v < 4.9.3203.5 ≤ v < 5.10.1243.5 ≤ v < 5.15.493.5 ≤ v < 5.18.63.5 ≤ v < 5.193.5 ≤ v < 5.4.2004.10 ≤ v < 4.14.2854.15 ≤ v < 4.19.2494.20 ≤ v < 5.4.2005.11 ≤ v < 5.15.495.16 ≤ v < 5.18.65.5 ≤ v < 5.10.1245.19 rc1a32e0eec7042b21ccb52896cf715e3e2641fed93

Vendor states this is fixed in 034246122f5c5e2e2a0b9fe04e24517920e9beb1 (fixed)

Vendor states this is fixed in 0e818d433fc2718fe4da044ffca7431812a7e04e (fixed)

Vendor states this is fixed in 27a37755ceb401111ded76810359d3adc4b268a1 (fixed)

Vendor states this is fixed in 2cf73c7cb6125083408d77f43d0e84d86aed0000 (fixed)

Vendor states this is fixed in 2f42389d270f2304c8855b0b63498a5a4d0c053d (fixed)

Vendor states this is fixed in 6c4e3486d21173d60925ef52e512cae727b43d30 (fixed)

Vendor states this is fixed in b8879ca1fd7348b4d5db7db86dcb97f60c73d751 (fixed)

Vendor states this is fixed in f638a84afef3dfe10554c51820c16e39a278c915 (fixed)

Vendor states this is fixed in 3.5 (unaffected)

Vendor states this is fixed in 4.14.285 (unaffected)

Vendor states this is fixed in 4.19.249 (unaffected)

Vendor states this is fixed in 4.9.320 (unaffected)

Vendor states this is fixed in 5.10.124 (unaffected)

Vendor states this is fixed in 5.15.49 (unaffected)

Vendor states this is fixed in 5.18.6 (unaffected)

Vendor states this is fixed in 5.19 (unaffected)

Vendor states this is fixed in 5.4.200 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references