LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49014: net: tun: Fix use-after-free in tun_detach()

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix use-after-free in tun_detach() syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673 CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x461 mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10237 [inline] netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb3d/0x2a30 kernel/exit.c:820 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net. This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49014 is a Linux kernel use-after-free bug in the TUN/TAP network driver cleanup path. It was found by syzbot and fixed upstream by changing when a socket reference is released. Business urgency depends on whether affected kernels and TUN/TAP functionality are present. No source here confirms active exploitation.

Executive priority

Treat as a routine-to-priority kernel maintenance item, not an emergency based on current evidence. Patch during the next appropriate maintenance window, faster for internet-facing infrastructure, VPN gateways, container hosts, and virtualization platforms running affected kernels.

Technical view

The bug is in tun_detach(). sock_put() could drop the last reference to struct net before later notifier handling accessed it, causing a KASAN use-after-free in notifier_call_chain(). The upstream fix moves sock_put() until after required struct net access is complete. The CVE record lists Linux kernel impact, but no CVSS score or CWE.

Likely exposure

Linux systems running affected kernel builds, especially hosts using TUN/TAP for VPNs, containers, virtualization, or network tunneling, may be exposed. Exact distro exposure requires checking vendor backports, because the CVE references upstream stable commits rather than every downstream package version.

Exploitation context

The public record describes syzbot-triggered kernel use-after-free behavior during TUN device close/detach. It does not provide confirmed real-world exploitation, exploit maturity, required privileges, or business impact. The CVE is not listed as KEV in the provided data.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploitability assessment, or KEV status is provided. Avoid assuming remote exploitability. Focus validation on kernel provenance, distro backports, and whether the TUN driver path is reachable in the environment.

Mitigation direction

  • Update to a vendor kernel containing the upstream stable fix or an equivalent backport.
  • Review Linux distribution advisories for CVE-2022-49014 package-specific status.
  • Prioritize systems where TUN/TAP is used for VPN, container, or virtualization networking.
  • If immediate patching is impossible, follow vendor guidance for exposure reduction.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and images.
  • Check whether /dev/net/tun or TUN/TAP-dependent services are present.
  • Confirm installed kernel changelogs include one of the referenced stable fixes or a distro backport.
  • Track CVE-2022-49014 in vulnerability management until vendor status is resolved.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49014 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux83c1f36f9880814b24cdf6c2f91f66f61db65326, 83c1f36f9880814b24cdf6c2f91f66f61db65326, 83c1f36f9880814b24cdf6c2f91f66f61db65326, 83c1f36f9880814b24cdf6c2f91f66f61db65326, 83c1f36f9880814b24cdf6c2f91f66f61db65326, 83c1f36f9880814b24cdf6c2f91f66f61db65326unaffected
LinuxLinux4.17, 0, 4.19.268, 5.4.226, 5.10.158, 5.15.82, 6.0.12, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.