Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2022-49973: Linux kernel may crash on certain network receives
CVE-2022-49973 · published 1 year ago
Summary
A bug in the Linux kernel's network message handling can cause a crash when data is received in some configurations. It affects the main Linux kernel and several Ubuntu kernel packages (HWE, AWS, Azure). Updating to the latest kernel version that includes the fix will resolve the issue.
What to do
- Update canonical linux-aws-5.15 to version 5.15.0-1027.31~20.04.1.
- Update canonical linux-azure-5.15 to version 5.15.0-1030.37~20.04.1.
- Update canonical linux-gcp-5.15 to version 5.15.0-1027.34~20.04.1.
- Update canonical linux-hwe-5.15 to version 5.15.0-57.63~20.04.1.
- Update canonical linux-intel-iotg-5.15 to version 5.15.0-1023.28~20.04.1.
- Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-58.64~20.04.1.
- Update canonical linux-oracle-5.15 to version 5.15.0-1027.33~20.04.1.
- Update canonical linux-riscv-5.15 to version 5.15.0-1027.31~20.04.1.
- Update canonical linux to version 5.15.0-57.63.
- Update canonical linux-aws to version 5.15.0-1027.31.
- Update canonical linux-azure to version 5.15.0-1030.37.
- Update canonical linux-gcp to version 5.15.0-1026.33.
- Update canonical linux-gke to version 5.15.0-1024.29.
- Update canonical linux-gkeop to version 5.15.0-1012.16.
- Update canonical linux-ibm to version 5.15.0-1022.25.
- Update canonical linux-intel-iotg to version 5.15.0-1023.28.
- Update canonical linux-kvm to version 5.15.0-1025.30.
- Update canonical linux-lowlatency to version 5.15.0-57.63.
- Update canonical linux-oracle to version 5.15.0-1026.32.
- Update canonical linux-raspi to version 5.15.0-1022.24.
- Update canonical linux-realtime to version 5.15.0-1029.32.
- Update canonical linux-azure-fde to version 5.15.0-1030.37.1.
- Update linux kernel to version 5.19.8.
- Update debian linux to version 6.0.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.15.61, < 5.15.66 >= 5.18.18, < 5.19 >= 5.19.2, < 5.19.8 6.0 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.15 |
< 5.15.0-1027.31~20.04.1 Fix: upgrade to 5.15.0-1027.31~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.15 |
< 5.15.0-1030.37~20.04.1 Fix: upgrade to 5.15.0-1030.37~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.15 |
< 5.15.0-1027.34~20.04.1 Fix: upgrade to 5.15.0-1027.34~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.15 |
< 5.15.0-57.63~20.04.1 Fix: upgrade to 5.15.0-57.63~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-intel-iotg-5.15 |
< 5.15.0-1023.28~20.04.1 Fix: upgrade to 5.15.0-1023.28~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 |
< 5.15.0-58.64~20.04.1 Fix: upgrade to 5.15.0-58.64~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.15 |
< 5.15.0-1027.33~20.04.1 Fix: upgrade to 5.15.0-1027.33~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.15 |
< 5.15.0-1027.31~20.04.1 Fix: upgrade to 5.15.0-1027.31~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
Showing 50 of 102. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux |
< 5.15.0-57.63 Fix: upgrade to 5.15.0-57.63
|
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws |
< 5.15.0-1027.31 Fix: upgrade to 5.15.0-1027.31
|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure |
< 5.15.0-1030.37 Fix: upgrade to 5.15.0-1030.37
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp |
< 5.15.0-1026.33 Fix: upgrade to 5.15.0-1026.33
|
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gke |
< 5.15.0-1024.29 Fix: upgrade to 5.15.0-1024.29
|
| Ubuntu:22.04:LTS | canonical | linux-gkeop |
< 5.15.0-1012.16 Fix: upgrade to 5.15.0-1012.16
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm |
< 5.15.0-1022.25 Fix: upgrade to 5.15.0-1022.25
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg |
< 5.15.0-1023.28 Fix: upgrade to 5.15.0-1023.28
|
| Ubuntu:22.04:LTS | canonical | linux-kvm |
< 5.15.0-1025.30 Fix: upgrade to 5.15.0-1025.30
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency |
< 5.15.0-57.63 Fix: upgrade to 5.15.0-57.63
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle |
< 5.15.0-1026.32 Fix: upgrade to 5.15.0-1026.32
|
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-raspi |
< 5.15.0-1022.24 Fix: upgrade to 5.15.0-1022.24
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime |
< 5.15.0-1029.32 Fix: upgrade to 5.15.0-1029.32
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde |
< 5.15.0-1030.37.1 Fix: upgrade to 5.15.0-1030.37.1
|
| Linux | linux | kernel |
>= 5.19.2, < 5.19.8 Fix: upgrade to 5.19.8
|
| Debian:12 | debian | linux |
< 6.0.2-1 Fix: upgrade to 6.0.2-1
|
Original advisory text
skmsg: Fix wrong last sg check in sk_msg_recvmsg()
In the Linux kernel, the following vulnerability has been resolved: skmsg: Fix wrong last sg check in sk_msg_recvmsg() Fix one kernel NULL pointer dereference as below: [ 224.462334] Call Trace: [ 224.462394] __tcp_bpf_recvmsg+0xd3/0x380 [ 224.462441] ? sock_has_perm+0x78/0xa0 [ 224.462463] tcp_bpf_recvmsg+0x12e/0x220 [ 224.462494] inet_recvmsg+0x5b/0xd0 [ 224.462534] __sys_recvfrom+0xc8/0x130 [ 224.462574] ? syscall_trace_enter+0x1df/0x2e0 [ 224.462606] ? __do_page_fault+0x2de/0x500 [ 224.462635] __x64_sys_recvfrom+0x24/0x30 [ 224.462660] do_syscall_64+0x5d/0x1d0 [ 224.462709] entry_SYSCALL_64_after_hwframe+0x65/0xca In commit 9974d37ea75f ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()"), we change last sg check to sg_is_last(), but in sockmap redirection case (without stream_parser/stream_verdict/ skb_verdict), we did not mark the end of the scatterlist. Check the sk_msg_alloc, sk_msg_page_add, and bpf_msg_push_data functions, they all do not mark the end of sg. They are expected to use sg.end for end judgment. So the judgment of '(i != msg_rx->sg.end)' is added back here.
References
- https://git.kernel.org/stable/c/10ee118a1756141f8e9c87aa7344ed12b41630a8 Third Party Advisory
- https://git.kernel.org/stable/c/583585e48d965338e73e1eb383768d16e0922d73 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49973... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-49973 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://ubuntu.com/security/CVE-2022-49973 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-49973 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-49973 Vendor Advisory
- https://git.kernel.org/stable/c/de22cba333d8699ad77e79f862fe1320cb1284de Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.8
Medium
Type
CWE-476NULL Pointer Dereference
Timeline
Published18 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2022-49973 · NVD
CVE-2022-49973 · OSV
UBUNTU-CVE-2022-49973 · OSV
DEBIAN-CVE-2022-49973 · OSV
Track software like this
Free during beta