CVE-2022-49015

net: hsr: Fix potential use-after-free

State: Published
Severity: 8.8 High
Published: Oct 21, 2024
Updated: Aug 5, 2026
Reserved: Aug 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: hsr: Fix potential use-after-free

The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f421436a591d34fa5279b54a96ac07d70250cc8d to before 8393ce5040803666bfa26a3a7bf41e44fab0ace9Affected f421436a591d34fa5279b54a96ac07d70250cc8d to before 4b351609af4fdbc23f79ab2b12748f4403ea9af4Affected f421436a591d34fa5279b54a96ac07d70250cc8d to before b35d899854d5d5d58eb7d7e7c0f61afc60d3a9e9Affected f421436a591d34fa5279b54a96ac07d70250cc8d to before 53a62c5efe91665f7a41fad0f888a96f94dc59ebAffected f421436a591d34fa5279b54a96ac07d70250cc8d to before 7ca81a161e406834a1fdc405fc83a572bd14b8d9Affected f421436a591d34fa5279b54a96ac07d70250cc8d to before dca370e575d9b6c983f5015e8dc035e23e219ee6Affected f421436a591d34fa5279b54a96ac07d70250cc8d to before f3add2b8cf620966de3ebfa07679ca12d33ec26fAffected f421436a591d34fa5279b54a96ac07d70250cc8d to before 7e177d32442b7ed08a9fa61b61724abc548cb248Affected
LinuxLinux	3.13Affected before 3.13Not affected 4.9.335 through 4.9.Not affected 4.14.301 through 4.14.Not affected 4.19.268 through 4.19.Not affected 5.4.226 through 5.4.Not affected 5.10.158 through 5.10.Not affected 5.15.82 through 5.15.Not affected 6.0.12 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

f421436a591d34fa5279b54a96ac07d70250cc8d to before 8393ce5040803666bfa26a3a7bf41e44fab0ace9Affected
f421436a591d34fa5279b54a96ac07d70250cc8d to before 4b351609af4fdbc23f79ab2b12748f4403ea9af4Affected
f421436a591d34fa5279b54a96ac07d70250cc8d to before b35d899854d5d5d58eb7d7e7c0f61afc60d3a9e9Affected
f421436a591d34fa5279b54a96ac07d70250cc8d to before 53a62c5efe91665f7a41fad0f888a96f94dc59ebAffected
f421436a591d34fa5279b54a96ac07d70250cc8d to before 7ca81a161e406834a1fdc405fc83a572bd14b8d9Affected
f421436a591d34fa5279b54a96ac07d70250cc8d to before dca370e575d9b6c983f5015e8dc035e23e219ee6Affected
f421436a591d34fa5279b54a96ac07d70250cc8d to before f3add2b8cf620966de3ebfa07679ca12d33ec26fAffected
f421436a591d34fa5279b54a96ac07d70250cc8d to before 7e177d32442b7ed08a9fa61b61724abc548cb248Affected

LinuxLinux

3.13Affected
before 3.13Not affected
4.9.335 through 4.9.*Not affected
4.14.301 through 4.14.*Not affected
4.19.268 through 4.19.*Not affected
5.4.226 through 5.4.*Not affected
5.10.158 through 5.10.*Not affected
5.15.82 through 5.15.*Not affected
6.0.12 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.