CVE-2022-49728

Medium

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.

Package Linux Kernel
Published 2025-02-26
Last modified 2025-11-03
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-190

CVE-2022-49728 is a Integer Overflow vulnerability

What is Integer Overflow?

The product performs a calculation that can produce an integer overflow, leading to unexpected values. Learn more on MITRE CWE

Affected versions

Linux kernel versions 2.6.12 and later are affected. Fixed in 5.10.236, 5.15.180, 5.18.6, 5.19 and their respective stable series.

Affected from
≥ 2.6.12
Fixed in
✓ 5.10.236 5.10.x ✓ 5.15.180 5.15.x ✓ 5.18.6 5.18.x ✓ 5.19

References

The following references provide additional information about CVE-2022-49728 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

4 patch commits total View all on NVD

Frequently asked questions

  • What is CVE-2022-49728?

    CVE-2022-49728 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as an Integer Overflow flaw (CWE-190) . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.10.236, 5.15.180, 5.18.6 and others. CVE-2022-49728 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2022-49728?

    CVE-2022-49728 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2022-49728?

    Yes — CVE-2022-49728 has been patched. Fixed versions include 5.10.236, 5.15.180, 5.18.6 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2022-49728 actively exploited?

    No — CVE-2022-49728 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

  • What is Integer Overflow (CWE-190)?

    The product performs a calculation that can produce an integer overflow, leading to unexpected values. View CWE-190 on MITRE CWE →

Back to
All CVEs
View on
NVD / NIST