CVE-2022-49727

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 2cf73c7cb6125083408d77f43d0e84d86aed0000Affected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 0e818d433fc2718fe4da044ffca7431812a7e04eAffected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 6c4e3486d21173d60925ef52e512cae727b43d30Affected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 2f42389d270f2304c8855b0b63498a5a4d0c053dAffected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before b8879ca1fd7348b4d5db7db86dcb97f60c73d751Affected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 27a37755ceb401111ded76810359d3adc4b268a1Affected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 034246122f5c5e2e2a0b9fe04e24517920e9beb1Affected a32e0eec7042b21ccb52896cf715e3e2641fed93 to before f638a84afef3dfe10554c51820c16e39a278c915Affected
LinuxLinux	3.5Affected before 3.5Not affected 4.9.320 through 4.9.Not affected 4.14.285 through 4.14.Not affected 4.19.249 through 4.19.Not affected 5.4.200 through 5.4.Not affected 5.10.124 through 5.10.Not affected 5.15.49 through 5.15.Not affected 5.18.6 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 2cf73c7cb6125083408d77f43d0e84d86aed0000Affected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 0e818d433fc2718fe4da044ffca7431812a7e04eAffected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 6c4e3486d21173d60925ef52e512cae727b43d30Affected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 2f42389d270f2304c8855b0b63498a5a4d0c053dAffected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before b8879ca1fd7348b4d5db7db86dcb97f60c73d751Affected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 27a37755ceb401111ded76810359d3adc4b268a1Affected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before 034246122f5c5e2e2a0b9fe04e24517920e9beb1Affected
a32e0eec7042b21ccb52896cf715e3e2641fed93 to before f638a84afef3dfe10554c51820c16e39a278c915Affected

LinuxLinux

3.5Affected
before 3.5Not affected
4.9.320 through 4.9.*Not affected
4.14.285 through 4.14.*Not affected
4.19.249 through 4.19.*Not affected
5.4.200 through 5.4.*Not affected
5.10.124 through 5.10.*Not affected
5.15.49 through 5.15.*Not affected
5.18.6 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.