LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49863: can: af_can: fix NULL pointer dereference in can_rx_register()

In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rx_register() It causes NULL pointer dereference when testing as following: (a) use syscall(__NR_socket, 0x10ul, 3ul, 0) to create netlink socket. (b) use syscall(__NR_sendmsg, ...) to create bond link device and vxcan link device, and bind vxcan device to bond device (can also use ifenslave command to bind vxcan device to bond device). (c) use syscall(__NR_socket, 0x1dul, 3ul, 1) to create CAN socket. (d) use syscall(__NR_bind, ...) to bind the bond device to CAN socket. The bond device invokes the can-raw protocol registration interface to receive CAN packets. However, ml_priv is not allocated to the dev, dev_rcv_lists is assigned to NULL in can_rx_register(). In this case, it will occur the NULL pointer dereference issue. The following is the stack information: BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 122a4067 P4D 122a4067 PUD 1223c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:can_rx_register+0x12d/0x1e0 Call Trace: <TASK> raw_enable_filters+0x8d/0x120 raw_enable_allfilters+0x3b/0x130 raw_bind+0x118/0x4f0 __sys_bind+0x163/0x1a0 __x64_sys_bind+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can let a local user crash the kernel through CAN socket handling when an incompatible network device is bound. The business impact is availability, not data theft. Treat it as a stability and denial-of-service issue for Linux systems that expose local accounts or containerized workloads with relevant network capabilities.

Executive priority

Patch during the next normal security maintenance window, faster for shared Linux hosts or systems where untrusted local workloads can manipulate networking. This is not a remote takeover based on supplied evidence, but it can cause outages.

Technical view

CVE-2022-49863 is a CWE-476 NULL pointer dereference in Linux CAN af_can can_rx_register(). Binding a bond-backed vxcan path to a CAN raw socket can leave ml_priv absent and dev_rcv_lists NULL, causing a kernel oops. CVSS is 5.5: local, low complexity, low privileges, no user interaction, high availability impact.

Likely exposure

Exposure is most plausible on Linux hosts running affected kernel ranges with CAN, vxcan, bonding, and local users or workloads able to create or bind relevant sockets/devices. The source bundle lists affected Linux versions including 5.12, 5.4.225, 5.10.155, 5.15.79, 6.0.9, and 6.1, but distro backports may differ.

Exploitation context

The supplied sources describe a local crash scenario and show kernel stack evidence. They do not show remote exploitation, data compromise, public weaponization, or active exploitation. KEV is false in the bundle, so active exploitation should not be claimed from this evidence.

Researcher notes

Focus review on local privilege boundaries, enabled CAN modules, bonding/vxcan support, and capability exposure. The affected-version data includes upstream versions and commit identifiers, so rely on distro advisories and package changelogs for final applicability decisions.

Mitigation direction

  • Update affected Linux kernels using vendor packages or the referenced stable kernel fixes.
  • Check distribution advisories because fixed status may differ from upstream version strings.
  • Prioritize multi-user, container, CI, and edge systems where local workloads have network capabilities.
  • Reduce unnecessary local access and network administration capabilities until patched.
  • Avoid direct wrangler or deployment assumptions; this is an operating-system patching issue.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, appliances, and edge nodes.
  • Identify systems using CAN, vxcan, bonding, or workloads with network administration capability.
  • Compare installed kernels with vendor fixed packages and referenced stable commits.
  • Confirm KEV status remains false before describing active exploitation.
  • Do not validate by intentionally crashing production kernels.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-49863 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2022-49863Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4ac1feff6ea6495cbfd336f4438a6c6d140544a6, 1a5751d58b14195f763b8c1d9ef33fb8a93e95e7, 4e096a18867a5a989b510f6999d9c6b6622e8f7b, 4e096a18867a5a989b510f6999d9c6b6622e8f7b, 4e096a18867a5a989b510f6999d9c6b6622e8f7b, 96340078d50a54f6a1252c62596bc44321c8bff9, 5.4.110, 5.10.28, 5.11.12unaffected
LinuxLinux5.12, 0, 5.4.225, 5.10.155, 5.15.79, 6.0.9, 6.1affected
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs