{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49636", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T02:21:30.429Z", "datePublished": "2025-02-26T02:23:46.222Z", "dateUpdated": "2026-05-23T15:22:36.202Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:22:36.202Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: fix memory leak in vlan_newlink()\n\nBlamed commit added back a bug I fixed in commit 9bbd917e0bec\n(\"vlan: fix memory leak in vlan_dev_set_egress_priority\")\n\nIf a memory allocation fails in vlan_changelink() after other allocations\nsucceeded, we need to call vlan_dev_free_egress_priority()\nto free all allocated memory because after a failed ->newlink()\nwe do not call any methods like ndo_uninit() or dev->priv_destructor().\n\nIn following example, if the allocation for last element 2000:2001 fails,\nwe need to free eight prior allocations:\n\nip link add link dummy0 dummy0.100 type vlan id 100 \\\n\tegress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001\n\nsyzbot report was:\n\nBUG: memory leak\nunreferenced object 0xffff888117bd1060 (size 32):\ncomm \"syz-executor408\", pid 3759, jiffies 4294956555 (age 34.090s)\nhex dump (first 32 bytes):\n09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n[] kmalloc include/linux/slab.h:600 [inline]\n[] vlan_dev_set_egress_priority+0xed/0x170 net/8021q/vlan_dev.c:193\n[] vlan_changelink+0x178/0x1d0 net/8021q/vlan_netlink.c:128\n[] vlan_newlink+0x148/0x260 net/8021q/vlan_netlink.c:185\n[] rtnl_newlink_create net/core/rtnetlink.c:3363 [inline]\n[] __rtnl_newlink+0xa58/0xdc0 net/core/rtnetlink.c:3580\n[] rtnl_newlink+0x49/0x70 net/core/rtnetlink.c:3593\n[] rtnetlink_rcv_msg+0x21c/0x5c0 net/core/rtnetlink.c:6089\n[] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501\n[] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n[] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345\n[] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921\n[] sock_sendmsg_nosec net/socket.c:714 [inline]\n[] sock_sendmsg+0x56/0x80 net/socket.c:734\n[] ____sys_sendmsg+0x36c/0x390 net/socket.c:2488\n[] ___sys_sendmsg+0x8b/0xd0 net/socket.c:2542\n[] __sys_sendmsg net/socket.c:2571 [inline]\n[] __do_sys_sendmsg net/socket.c:2580 [inline]\n[] __se_sys_sendmsg net/socket.c:2578 [inline]\n[] __x64_sys_sendmsg+0x78/0xf0 net/socket.c:2578\n[] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n[] entry_SYSCALL_64_after_hwframe+0x46/0xb0" } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/8021q/vlan_netlink.c" ], "versions": [ { "version": "b195d229de401377f70c04e0dff93b342464ec8e", "lessThan": "549de58dba4bf1b2adc72e9948b9c76fa88be9d2", "status": "affected", "versionType": "git" }, { "version": "62d7ad2c191122119c66361ba6d9f04974b51afe", "lessThan": "df27729a4fe0002dfd80c96fe1c142829c672728", "status": "affected", "versionType": "git" }, { "version": "842801181864690fdcde73b017cce4c1353a7083", "lessThan": "f5dc10b910bdac523e5947336445a77066c51bf9", "status": "affected", "versionType": "git" }, { "version": "37aa50c539bcbcc01767e515bd170787fcfc0f33", "lessThan": "4c43069bb1097dd6cc1cf0f7c43a36d1f7b3910b", "status": "affected", "versionType": "git" }, { "version": "37aa50c539bcbcc01767e515bd170787fcfc0f33", "lessThan": "72a0b329114b1caa8e69dfa7cdad1dd3c69b8602", "status": "affected", "versionType": "git" }, { "version": "5.4.291", "lessThan": "5.4.292", "status": "affected", "versionType": "semver" }, { "version": "5.10.235", "lessThan": "5.10.236", "status": "affected", "versionType": "semver" }, { "version": "5.15.142", "lessThan": "5.15.180", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/8021q/vlan_netlink.c" ], "versions": [ { "version": "5.17", "status": "affected" }, { "version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.292", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.13", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.291", "versionEndExcluding": "5.4.292" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.235", "versionEndExcluding": "5.10.236" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.142", "versionEndExcluding": "5.15.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.18.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "5.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/549de58dba4bf1b2adc72e9948b9c76fa88be9d2" }, { "url": "https://git.kernel.org/stable/c/df27729a4fe0002dfd80c96fe1c142829c672728" }, { "url": "https://git.kernel.org/stable/c/f5dc10b910bdac523e5947336445a77066c51bf9" }, { "url": "https://git.kernel.org/stable/c/4c43069bb1097dd6cc1cf0f7c43a36d1f7b3910b" }, { "url": "https://git.kernel.org/stable/c/72a0b329114b1caa8e69dfa7cdad1dd3c69b8602" } ], "title": "vlan: fix memory leak in vlan_newlink()", "x_generator": { "engine": "bippy-1.2.0" } } } }