CVE-2022-49728

ipv6: Fix signed integer overflow in __ip6_append_data

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170

Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.29%Up 0.3 points since Feb 27, 2025

What each source reports

NVD Score used5.5

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

Record: CVE-2022-49728
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

CVE ListNo score

ipv6: Fix signed integer overflow in __ip6_append_data

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

Record: CVE-2022-49728
Updated: 2026-11-02

EUVDEUVD-2022-54507No score

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

Record: EUVD-2022-54507
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cwf6-gj87-3ghq5.5

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer...

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

Record: GHSA-cwf6-gj87-3ghq
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVAZL-580455.5

CVE-2022-49728 affecting package kernel for versions less than 5.15.180.1-1

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

Record: AZL-58045
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-497285.5

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.

Record: DEBIAN-CVE-2022-49728
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

Show 19 moreShow less

OSVUBUNTU-CVE-2022-497286.9

Record: UBUNTU-CVE-2022-49728
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1779434490No score

kernel: Fix of 100 CVEs

tracing: Verify event formats that have "%*p.." {CVE-2025-37938}
HID: pidff: Fix null pointer dereference in pidff_find_fields {CVE-2025-37862}
scsi: st: Fix array overflow in st_setup() {CVE-2025-37857}
drm/amdkfd: debugfs hang_hws skip GPU with MES {CVE-2025-37853}
mm/vmscan: don't try to reclaim hwpoison folio {CVE-2025-37834}
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() {CVE-2025-37830}
drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() {CVE-2025-37852}
cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() {CVE-2025-37829}
sound/virtio: Fix cancel_sync warnings on uninitialized work_structs {CVE-2025-37805}
net: tls: explicitly disallow disconnect {CVE-2025-37756}
drm/amd/pm: Prevent division by zero {CVE-2025-37770}
drm/amd/pm: Prevent division by zero {CVE-2025-37768}
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. {CVE-2025-22111}
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path {CVE-2025-23129}
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs {CVE-2025-22045}
ftrace: Avoid potential division by zero in function_stat_show() {CVE-2025-21898}
md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime {CVE-2025-21712}
bpf: Fix softlockup in arena_map_free on 64k page kernel {CVE-2025-21851}
RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" {CVE-2025-21829}
mm: zswap: properly synchronize freeing resources during CPU hotunplug {CVE-2025-21693}
drop_monitor: fix incorrect initialization order {CVE-2025-21862}
ptp: Ensure info->enable callback is always set {CVE-2025-21814}
efi: Don't map the entire mokvar table to determine its size {CVE-2025-21872}
drm/amd/display: Assign normalized_pix_clk when color depth = 14 {CVE-2025-21956}
net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() {CVE-2025-21848}
netfilter: nf_tables: reject mismatching sum of field_len with set key length {CVE-2025-21826}
mm: clear uffd-wp PTE/PMD state on mremap() {CVE-2025-21696}
wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
vxlan: check vxlan_vnigroup_init() return value {CVE-2025-21790}
ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
wifi: mac80211: don't flush non-uploaded STAs {CVE-2025-21828}
team: better TEAM_OPTION_TYPE_STRING validation {CVE-2025-21787}
ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
cgroup/cpuset: remove kernfs active break {CVE-2025-21634}
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() {CVE-2024-58083}
idpf: convert workqueues to unbound {CVE-2024-58057}
xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX {CVE-2024-58017}
Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() {CVE-2024-57988}
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections {CVE-2024-57986}
virtio-blk: don't keep queue frozen during system suspend {CVE-2024-57946}
drm/amd/display: Initialize denominator defaults to 1 {CVE-2024-57950}
fs: relax assertions on failure to encode file handles {CVE-2024-57924}
drm/amd/display: Add check for granularity in dml ceil/floor helpers {CVE-2024-57922}
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() {CVE-2024-56748}
ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() {CVE-2024-56782}
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() {CVE-2024-56747}
netdevsim: prevent bad user input in…

Record: CLSA-2026-1779434490
Updated: 2026-11-02

OSVCLSA-2026-1783791447No score

kernel: Fix of 307 CVEs

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
HID: betop: check shape of output reports {CVE-2023-53015}
mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
virtgpu: don't reset on shutdown {CVE-2025-38064}
xen/netfront: fix crash when removing device {CVE-2022-48969}
mptcp: do not fallback when OoO is present {CVE-2024-50185}
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
ext4: fix racy may inline data check in dio write {CVE-2023-52786}
drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
macsec: fix UAF bug for real_dev {CVE-2022-49390}
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
dlm: fix possible lkb_resource…

Record: CLSA-2026-1783791447
Updated: 2026-11-02

OSVNo score

ipv6: Fix signed integer overflow in __ip6_append_data

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in __ip6_append_data

Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.

Record: CVE-2022-49728
Updated: 2026-11-02

OSVSUSE-SU-2025:01600-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size (bsc#1237840).
CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (bsc#1238139).
CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (bsc#1238244).
CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (bsc#1238937).
CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors…

Record: SUSE-SU-2025:01600-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01983-1No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
CVE-2022-49835: ALSA: hda: fix potential memleak in…

Record: SUSE-SU-2025:01983-1
Updated: 2026-11-02

OSVUSN-7591-1No score

linux, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-kvm, linux-lowlatency, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-oracle vulnerabilities

Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. (CVE-2024-8805)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312)