CVE-2022-49066
published 2025-02-26CVE-2022-49066: In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
18.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
veth: Ensure eth header is in skb's linear part
After feeding a decapsulated packet to a veth device with act_mirred,
skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),
which expects at least ETH_HLEN byte of linear data (as
__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes
unconditionally).
Use pskb_may_pull() to ensure veth_xmit() respects this constraint.
kernel BUG at include/linux/skbuff.h:2328!
RIP: 0010:eth_type_trans+0xcf/0x140
Call Trace:
__dev_forward_skb2+0xe3/0x160
veth_xmit+0x6e/0x250 [veth]
dev_hard_start_xmit+0xc7/0x200
__dev_queue_xmit+0x47f/0x520
? skb_ensure_writable+0x85/0xa0
? skb_mpls_pop+0x98/0x1c0
tcf_mirred_act+0x442/0x47e [act_mirred]
tcf_action_exec+0x86/0x140
fl_classify+0x1d8/0x1e0 [cls_flower]
? dma_pte_clear_level+0x129/0x1a0
? dma_pte_clear_level+0x129/0x1a0
? prb_fill_curr_block+0x2f/0xc0
? skb_copy_bits+0x11a/0x220
__tcf_classify+0x58/0x110
tcf_classify_ingress+0x6b/0x140
__netif_receive_skb_core.constprop.0+0x47d/0xfd0
? __iommu_dma_unmap_swiotlb+0x44/0x90
__netif_receive_skb_one_core+0x3d/0xa0
netif_receive_skb+0x116/0x170
be_process_rx+0x22f/0x330 [be2net]
be_poll+0x13c/0x370 [be2net]
__napi_poll+0x2a/0x170
net_rx_action+0x22f/0x2f0
__do_softirq+0xca/0x2a8
__irq_exit_rcu+0xc1/0xe0
common_interrupt+0x83/0xa0
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.6-1 (bookworm) | linux 5.17.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < 3de2a02b60a4ef0ab76263216f08c7d095fc7c42 | 3de2a02b60a4ef0ab76263216f08c7d095fc7c42 |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < d417a859221f127e8edf09c14b76ab50f825e171 | d417a859221f127e8edf09c14b76ab50f825e171 |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < 1ef0088e43af1de4e3b365218c4d3179d9a37eec | 1ef0088e43af1de4e3b365218c4d3179d9a37eec |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < 2fd90b86dff413fbf8128780c04ea9c6849c16e2 | 2fd90b86dff413fbf8128780c04ea9c6849c16e2 |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < d67c900f1947d64ba8a64f693504bcaab8d9000c | d67c900f1947d64ba8a64f693504bcaab8d9000c |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < 93940fc4cb81840dc0fa202de48cccb949a0261d | 93940fc4cb81840dc0fa202de48cccb949a0261d |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < 46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27 | 46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27 |
| linux | linux | >= e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 < 726e2c5929de841fdcef4e2bf995680688ae1b87 | 726e2c5929de841fdcef4e2bf995680688ae1b87 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 2.6.24 < 4.9.311 | 4.9.311 |
| linux | linux_kernel | >= 4.10 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.239 | 4.19.239 |
| linux | linux_kernel | >= 4.20 < 5.4.190 | 5.4.190 |
| linux | linux_kernel | >= 5.11 < 5.15.35 | 5.15.35 |
| linux | linux_kernel | >= 5.16 < 5.17.4 | 5.17.4 |
| linux | linux_kernel | >= 5.5 < 5.10.112 | 5.10.112 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c8g8-mpjg-q8mg: In the Linux kernel, the following vulnerability has been resolved:
veth: Ensure eth header is in skb's linear part
After feeding a decapsulated pac
ghsa_unreviewed·2025-10-14
CVE-2022-49066 [MEDIUM] GHSA-c8g8-mpjg-q8mg: In the Linux kernel, the following vulnerability has been resolved:
veth: Ensure eth header is in skb's linear part
After feeding a decapsulated pac
In the Linux kernel, the following vulnerability has been resolved:
veth: Ensure eth header is in skb's linear part
After feeding a decapsulated packet to a veth device with act_mirred,
skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),
which expects at least ETH_HLEN byte of linear data (as
__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes
unconditionally).
Use pskb_may_pull() to ensure veth_xmit() respects this constraint.
kernel BUG at include/linux/skbuff.h:2328!
RIP: 0010:eth_type_trans+0xcf/0x140
Call Trace:
__dev_forward_skb2+0xe3/0x160
veth_xmit+0x6e/0x250 [veth]
dev_hard_start_xmit+0xc7/0x200
__dev_queue_xmit+0x47f/0x520
? skb_ensure_writable+0x85/0xa0
? skb_mpls_pop+0x98/0x1c0
tcf_mirred_act+0x442/0x47e [act_mirred]
tcf_action_exec+0x86/
OSV
CVE-2022-49066: In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packe
osv·2025-02-26·CVSS 5.5
CVE-2022-49066 [MEDIUM] CVE-2022-49066: In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packe
In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data (as __dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes unconditionally). Use pskb_may_pull() to ensure veth_xmit() respects this constraint. kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:eth_type_trans+0xcf/0x140 Call Trace: __dev_forward_skb2+0xe3/0x160 veth_xmit+0x6e/0x250 [veth] dev_hard_start_xmit+0xc7/0x200 __dev_queue_xmit+0x47f/0x520 ? skb_ensure_writable+0x85/0xa0 ? skb_mpls_pop+0x98/0x1c0 tcf_mirred_act+0x442/0x47e [act_mirred] tcf_action_exec+0x86/0x140
Red Hat
kernel: veth: Ensure eth header is in skb's linear part
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49066 [MEDIUM] kernel: veth: Ensure eth header is in skb's linear part
kernel: veth: Ensure eth header is in skb's linear part
In the Linux kernel, the following vulnerability has been resolved:
veth: Ensure eth header is in skb's linear part
After feeding a decapsulated packet to a veth device with act_mirred,
skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),
which expects at least ETH_HLEN byte of linear data (as
__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes
unconditionally).
Use pskb_may_pull() to ensure veth_xmit() respects this constraint.
kernel BUG at include/linux/skbuff.h:2328!
RIP: 0010:eth_type_trans+0xcf/0x140
Call Trace:
__dev_forward_skb2+0xe3/0x160
veth_xmit+0x6e/0x250 [veth]
dev_hard_start_xmit+0xc7/0x200
__dev_queue_xmit+0x47f/0x520
? skb_ensure_writable+0x85/0xa0
? skb_mpls_pop+0x98/0x1c0
tcf_mirr
Debian
CVE-2022-49066: linux - In the Linux kernel, the following vulnerability has been resolved: veth: Ensur...
vendor_debian·2022·CVSS 5.5
CVE-2022-49066 [MEDIUM] CVE-2022-49066: linux - In the Linux kernel, the following vulnerability has been resolved: veth: Ensur...
In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data (as __dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes unconditionally). Use pskb_may_pull() to ensure veth_xmit() respects this constraint. kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:eth_type_trans+0xcf/0x140 Call Trace: __dev_forward_skb2+0xe3/0x160 veth_xmit+0x6e/0x250 [veth] dev_hard_start_xmit+0xc7/0x200 __dev_queue_xmit+0x47f/0x520 ? skb_ensure_writable+0x85/0xa0 ? skb_mpls_pop+0x98/0x1c0 tcf_mirred_act+0x442/0x47e [act_mirred] tcf_action_exec+0x86/0x140
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/1ef0088e43af1de4e3b365218c4d3179d9a37eechttps://git.kernel.org/stable/c/2fd90b86dff413fbf8128780c04ea9c6849c16e2https://git.kernel.org/stable/c/3de2a02b60a4ef0ab76263216f08c7d095fc7c42https://git.kernel.org/stable/c/46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27https://git.kernel.org/stable/c/726e2c5929de841fdcef4e2bf995680688ae1b87https://git.kernel.org/stable/c/93940fc4cb81840dc0fa202de48cccb949a0261dhttps://git.kernel.org/stable/c/d417a859221f127e8edf09c14b76ab50f825e171https://git.kernel.org/stable/c/d67c900f1947d64ba8a64f693504bcaab8d9000c
2025-02-26
Published