CVE-2022-49812
published 2025-05-01CVE-2022-49812: In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver can…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
bridge: switchdev: Fix memory leaks when changing VLAN protocol
The bridge driver can offload VLANs to the underlying hardware either
via switchdev or the 8021q driver. When the former is used, the VLAN is
marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV'
private flag.
To avoid the memory leaks mentioned in the cited commit, the bridge
driver will try to delete a VLAN via the 8021q driver if the VLAN is not
marked with the previously mentioned flag.
When the VLAN protocol of the bridge changes, switchdev drivers are
notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but
the 8021q driver is also called to add the existing VLANs with the new
protocol and delete them with the old protocol.
In case the VLANs were offloaded via switchdev, the above behavior is
both redundant and buggy. Redundant because the VLANs are already
programmed in hardware and drivers that support VLAN protocol change
(currently only mlx5) change the protocol upon the switchdev attribute
notification. Buggy because the 8021q driver is called despite these
VLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to
memory leaks [1] when the VLANs are deleted.
Fix by not calling the 8021q driver for VLANs that were already
programmed via switchdev.
[1]
unreferenced object 0xffff8881f6771200 (size 256):
comm "ip", pid 446855, jiffies 4298238841 (age 55.240s)
hex dump (first 32 bytes):
00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[] vlan_vid_add+0x437/0x750
[] __br_vlan_set_proto+0x289/0x920
[] br_changelink+0x3d6/0x13f0
[] __rtnl_newlink+0x8ae/0x14c0
[] rtnl_newlink+0x5f/0x90
[] rtnetlink_rcv_msg+0x336/0xa00
[] netlink_rcv_skb+0x11d/0x340
[] netlink_unicast+0x438/0x710
[] netlink_sendmsg+0x788/0xc40
[] sock_sendmsg+0xb0/0xe0
[] ____sys_sendmsg+0x4ff/0x6d0
[] ___sys_sendmsg+0x12e/0x1b0
[
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.10-1 (bookworm) | linux 6.0.10-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 279737939a8194f02fa352ab4476a1b241f44ef4 < 347f1793b573466424c550f2748ed837b6690fe7 | 347f1793b573466424c550f2748ed837b6690fe7 |
| linux | linux | >= 279737939a8194f02fa352ab4476a1b241f44ef4 < fc16a2c81a3eb1cbba8775f5bdc67856df903a7c | fc16a2c81a3eb1cbba8775f5bdc67856df903a7c |
| linux | linux | >= 279737939a8194f02fa352ab4476a1b241f44ef4 < f8926e2d2225eb7b7e11cd3fa266aaad9075b767 | f8926e2d2225eb7b7e11cd3fa266aaad9075b767 |
| linux | linux | >= 279737939a8194f02fa352ab4476a1b241f44ef4 < 9d45921ee4cb364910097e7d1b7558559c2f9fd2 | 9d45921ee4cb364910097e7d1b7558559c2f9fd2 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 5.0.1 < 5.10.157 | 5.10.157 |
| linux | linux_kernel | >= 5.11 < 5.15.80 | 5.15.80 |
| linux | linux_kernel | >= 5.16 < 6.0.10 | 6.0.10 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-49812: In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver
osv·2025-05-01·CVSS 5.5
CVE-2022-49812 [MEDIUM] CVE-2022-49812: In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver
In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver can offload VLANs to the underlying hardware either via switchdev or the 8021q driver. When the former is used, the VLAN is marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV' private flag. To avoid the memory leaks mentioned in the cited commit, the bridge driver will try to delete a VLAN via the 8021q driver if the VLAN is not marked with the previously mentioned flag. When the VLAN protocol of the bridge changes, switchdev drivers are notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but the 8021q driver is also called to add the existing VLANs with the new protocol and delete them with the old protocol.
GHSA
GHSA-9x8c-4rx4-5mxv: In the Linux kernel, the following vulnerability has been resolved:
bridge: switchdev: Fix memory leaks when changing VLAN protocol
The bridge drive
ghsa_unreviewed·2025-05-01
CVE-2022-49812 [MEDIUM] CWE-401 GHSA-9x8c-4rx4-5mxv: In the Linux kernel, the following vulnerability has been resolved:
bridge: switchdev: Fix memory leaks when changing VLAN protocol
The bridge drive
In the Linux kernel, the following vulnerability has been resolved:
bridge: switchdev: Fix memory leaks when changing VLAN protocol
The bridge driver can offload VLANs to the underlying hardware either
via switchdev or the 8021q driver. When the former is used, the VLAN is
marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV'
private flag.
To avoid the memory leaks mentioned in the cited commit, the bridge
driver will try to delete a VLAN via the 8021q driver if the VLAN is not
marked with the previously mentioned flag.
When the VLAN protocol of the bridge changes, switchdev drivers are
notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but
the 8021q driver is also called to add the existing VLANs with the new
protocol and delete them with the old protoc
Red Hat
kernel: bridge: switchdev: Fix memory leaks when changing VLAN protocol
vendor_redhat·2025-05-01·CVSS 5.5
CVE-2022-49812 [MEDIUM] kernel: bridge: switchdev: Fix memory leaks when changing VLAN protocol
kernel: bridge: switchdev: Fix memory leaks when changing VLAN protocol
In the Linux kernel, the following vulnerability has been resolved:
bridge: switchdev: Fix memory leaks when changing VLAN protocol
The bridge driver can offload VLANs to the underlying hardware either
via switchdev or the 8021q driver. When the former is used, the VLAN is
marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV'
private flag.
To avoid the memory leaks mentioned in the cited commit, the bridge
driver will try to delete a VLAN via the 8021q driver if the VLAN is not
marked with the previously mentioned flag.
When the VLAN protocol of the bridge changes, switchdev drivers are
notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but
the 8021q driver is also called to add the exi
Debian
CVE-2022-49812: linux - In the Linux kernel, the following vulnerability has been resolved: bridge: swi...
vendor_debian·2022·CVSS 5.5
CVE-2022-49812 [MEDIUM] CVE-2022-49812: linux - In the Linux kernel, the following vulnerability has been resolved: bridge: swi...
In the Linux kernel, the following vulnerability has been resolved: bridge: switchdev: Fix memory leaks when changing VLAN protocol The bridge driver can offload VLANs to the underlying hardware either via switchdev or the 8021q driver. When the former is used, the VLAN is marked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV' private flag. To avoid the memory leaks mentioned in the cited commit, the bridge driver will try to delete a VLAN via the 8021q driver if the VLAN is not marked with the previously mentioned flag. When the VLAN protocol of the bridge changes, switchdev drivers are notified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but the 8021q driver is also called to add the existing VLANs with the new protocol and delete them with the old protocol.
No detection rules found.
No public exploits indexed.
2025-05-01
Published