LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49865: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network When copying a `struct ifaddrlblmsg` to the network, __ifal_reserved remained uninitialized, resulting in a 1-byte infoleak: BUG: KMSAN: kernel-network-infoleak in __netdev_start_xmit ./include/linux/netdevice.h:4841 __netdev_start_xmit ./include/linux/netdevice.h:4841 netdev_start_xmit ./include/linux/netdevice.h:4857 xmit_one net/core/dev.c:3590 dev_hard_start_xmit+0x1dc/0x800 net/core/dev.c:3606 __dev_queue_xmit+0x17e8/0x4350 net/core/dev.c:4256 dev_queue_xmit ./include/linux/netdevice.h:3009 __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 __netlink_deliver_tap+0x728/0xad0 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1263 netlink_sendskb+0x1d9/0x200 net/netlink/af_netlink.c:1272 netlink_unicast+0x56d/0xf50 net/netlink/af_netlink.c:1360 nlmsg_unicast ./include/net/netlink.h:1061 rtnl_unicast+0x5a/0x80 net/core/rtnetlink.c:758 ip6addrlbl_get+0xfad/0x10f0 net/ipv6/addrlabel.c:628 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 ... Uninit was created at: slab_post_alloc_hook+0x118/0xb00 mm/slab.h:742 slab_alloc_node mm/slub.c:3398 __kmem_cache_alloc_node+0x4f2/0x930 mm/slub.c:3437 __do_kmalloc_node mm/slab_common.c:954 __kmalloc_node_track_caller+0x117/0x3d0 mm/slab_common.c:975 kmalloc_reserve net/core/skbuff.c:437 __alloc_skb+0x27a/0xab0 net/core/skbuff.c:509 alloc_skb ./include/linux/skbuff.h:1267 nlmsg_new ./include/net/netlink.h:964 ip6addrlbl_get+0x490/0x10f0 net/ipv6/addrlabel.c:608 rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082 netlink_rcv_skb+0x299/0x550 net/netlink/af_netlink.c:2540 rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:6109 netlink_unicast_kernel net/netlink/af_netlink.c:1319 netlink_unicast+0x9ab/0xf50 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xebc/0x10f0 net/netlink/af_netlink.c:1921 ... This patch ensures that the reserved field is always initialized.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2022-49865 is a Linux kernel information leak in IPv6 address label handling. A kernel response could include one uninitialized reserved byte, exposing a very small amount of kernel memory data. The source bundle shows a patch initializes that field, and does not show active exploitation or a CVSS score.

Executive priority

Treat as routine kernel hygiene unless the organization runs multi-tenant Linux infrastructure with delayed patching. Business urgency is lower than memory corruption or privilege escalation issues, but kernel updates should still enter the normal remediation cycle.

Technical view

In Linux IPv6 addrlabel rtnetlink handling, struct ifaddrlblmsg.__ifal_reserved was copied without initialization. KMSAN reported a 1-byte kernel-network-infoleak during ip6addrlbl_get response construction. The fix initializes the reserved field before sending the message.

Likely exposure

Exposure is most relevant to systems running affected Linux kernel versions with IPv6 address label rtnetlink functionality present. The bundle lists Linux kernels including 2.6.25 and several stable series points as affected, but lacks complete distribution mapping.

Exploitation context

The provided sources do not show active exploitation, public exploit availability, or KEV listing. The issue appears to require interaction with the kernel rtnetlink IPv6 address label path and leaks only one uninitialized byte per affected response.

Researcher notes

The source evidence is narrow: an upstream kernel fix and KMSAN trace showing uninitialized __ifal_reserved leakage. It supports an information disclosure classification, but not broader impact claims, remote reachability, or exploit maturity.

Mitigation direction

  • Apply the relevant Linux stable kernel update containing the referenced fix.
  • Use vendor distribution advisories to map package versions to fixed kernels.
  • Prioritize internet-facing or multi-tenant Linux systems using affected kernel lines.
  • If patch timing is constrained, review vendor guidance for temporary controls.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, containers hosts, and images.
  • Map installed distribution kernel packages to vendor-fixed builds for CVE-2022-49865.
  • Confirm deployed kernels include one of the referenced stable commits or downstream equivalents.
  • Check vulnerability scanner findings against actual running kernel versions, not only installed packages.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49865 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339a, 2a8cc6c89039e0530a3335954253b76ed0f9339aunaffected
LinuxLinux2.6.25, 0, 4.9.334, 4.14.300, 4.19.267, 5.4.225, 5.10.155, 5.15.79, 6.0.9, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.