CVE-2022-49048

What it is

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix panic when forwarding a pkt with no in6 dev kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5%

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-02-26 07:00 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-15 22:17 UTC Last updatedMost recent change to the record

Details

Published

2025-02-26 07:00 UTC

Last modified

2026-10-15 22:17 UTC

Exploit probability

0.7% · EPSS, next 30 days

Record status

Modified

Affected

• Linux Kernel < 4.19.239
• Linux Kernel < 5.4.190
• Linux Kernel < 5.10.112
• Linux Kernel < 5.14
• Linux Kernel < 5.15.35
• Linux Kernel < 5.17.4
• Linux Kernel 5.14
• Linux Kernel 5.18

Attack profile CVSS 3.1 · 7.5

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High