CVE-2022-49066

veth: Ensure eth header is in skb's linear part

State: Published
Severity: Not scored
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

veth: Ensure eth header is in skb's linear part

After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data (as __dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes unconditionally).

Use pskb_may_pull() to ensure veth_xmit() respects this constraint.

kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:eth_type_trans+0xcf/0x140 Call Trace: <IRQ> __dev_forward_skb2+0xe3/0x160 veth_xmit+0x6e/0x250 [veth] dev_hard_start_xmit+0xc7/0x200 __dev_queue_xmit+0x47f/0x520 ? skb_ensure_writable+0x85/0xa0 ? skb_mpls_pop+0x98/0x1c0 tcf_mirred_act+0x442/0x47e [act_mirred] tcf_action_exec+0x86/0x140 fl_classify+0x1d8/0x1e0 [cls_flower] ? dma_pte_clear_level+0x129/0x1a0 ? dma_pte_clear_level+0x129/0x1a0 ? prb_fill_curr_block+0x2f/0xc0 ? skb_copy_bits+0x11a/0x220 __tcf_classify+0x58/0x110 tcf_classify_ingress+0x6b/0x140 __netif_receive_skb_core.constprop.0+0x47d/0xfd0 ? __iommu_dma_unmap_swiotlb+0x44/0x90 __netif_receive_skb_one_core+0x3d/0xa0 netif_receive_skb+0x116/0x170 be_process_rx+0x22f/0x330 [be2net] be_poll+0x13c/0x370 [be2net] __napi_poll+0x2a/0x170 net_rx_action+0x22f/0x2f0 __do_softirq+0xca/0x2a8 __irq_exit_rcu+0xc1/0xe0 common_interrupt+0x83/0xa0

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 3de2a02b60a4ef0ab76263216f08c7d095fc7c42Affected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before d417a859221f127e8edf09c14b76ab50f825e171Affected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 1ef0088e43af1de4e3b365218c4d3179d9a37eecAffected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 2fd90b86dff413fbf8128780c04ea9c6849c16e2Affected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before d67c900f1947d64ba8a64f693504bcaab8d9000cAffected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 93940fc4cb81840dc0fa202de48cccb949a0261dAffected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27Affected e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 726e2c5929de841fdcef4e2bf995680688ae1b87Affected
LinuxLinux	2.6.24Affected before 2.6.24Not affected 4.9.311 through 4.9.Not affected 4.14.276 through 4.14.Not affected 4.19.239 through 4.19.Not affected 5.4.190 through 5.4.Not affected 5.10.112 through 5.10.Not affected 5.15.35 through 5.15.Not affected 5.17.4 through 5.17.*Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 3de2a02b60a4ef0ab76263216f08c7d095fc7c42Affected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before d417a859221f127e8edf09c14b76ab50f825e171Affected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 1ef0088e43af1de4e3b365218c4d3179d9a37eecAffected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 2fd90b86dff413fbf8128780c04ea9c6849c16e2Affected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before d67c900f1947d64ba8a64f693504bcaab8d9000cAffected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 93940fc4cb81840dc0fa202de48cccb949a0261dAffected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 46bc359fec0c6d87b70d7a008bcd9a5e30dd6f27Affected
e314dbdc1c0dc6a548ecf0afce28ecfd538ff568 to before 726e2c5929de841fdcef4e2bf995680688ae1b87Affected

LinuxLinux

2.6.24Affected
before 2.6.24Not affected
4.9.311 through 4.9.*Not affected
4.14.276 through 4.14.*Not affected
4.19.239 through 4.19.*Not affected
5.4.190 through 5.4.*Not affected
5.10.112 through 5.10.*Not affected
5.15.35 through 5.15.*Not affected
5.17.4 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.