GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48851 (GCVE-0-2022-48851)

Vulnerability from cvelistv5 – Published: 2024-07-16 12:25 – Updated: 2026-08-05 08:52
VLAI
Title
staging: gdm724x: fix use after free in gdm_lte_rx()
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:26 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 61e121047645122c47714fcda684d0ee67f444af , < 6dc7b87c62423bfa68139fe95e85028aab584c9a (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < 83a9c886c2b5a0d28c0b37e1736b47f38d61332a (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < 48ecdf3e29a6e514e8196691589c7dfc6c4ac169 (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < 403e3afe241b62401de1f8629c9c6b9b3d69dbff (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < 6d9700b445098dbbce0caff4b8cfca214cf1e757 (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < 1fb9dd3787495b4deb0efe66c58306b65691a48f (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < d39dc79513e99147b4c158a8a9e46743e23944f5 (git)
Affected: 61e121047645122c47714fcda684d0ee67f444af , < fc7f750dc9d102c1ed7bbe4591f991e770c99033 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 4.9.307 , ≤ 4.9.* (semver)
Unaffected: 4.14.272 , ≤ 4.14.* (semver)
Unaffected: 4.19.235 , ≤ 4.19.* (semver)
Unaffected: 5.4.185 , ≤ 5.4.* (semver)
Unaffected: 5.10.106 , ≤ 5.10.* (semver)
Unaffected: 5.15.29 , ≤ 5.15.* (semver)
Unaffected: 5.16.15 , ≤ 5.16.* (semver)
Unaffected: 5.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:26:05.468000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:08.533Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/gdm724x/gdm_lte.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6dc7b87c62423bfa68139fe95e85028aab584c9a",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "83a9c886c2b5a0d28c0b37e1736b47f38d61332a",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "48ecdf3e29a6e514e8196691589c7dfc6c4ac169",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "403e3afe241b62401de1f8629c9c6b9b3d69dbff",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "6d9700b445098dbbce0caff4b8cfca214cf1e757",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "1fb9dd3787495b4deb0efe66c58306b65691a48f",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "d39dc79513e99147b4c158a8a9e46743e23944f5",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            },
            {
              "lessThan": "fc7f750dc9d102c1ed7bbe4591f991e770c99033",
              "status": "affected",
              "version": "61e121047645122c47714fcda684d0ee67f444af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/gdm724x/gdm_lte.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.307",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.272",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.235",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.185",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.106",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.29",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.15",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can\u0027t dereference it to\nsave the skb-\u003elen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - gdm_lte_rx() is the RX completion path of the GDM724x LTE WWAN netdev; a remote peer that can deliver packets over the cellular/IP path causes the modem to submit LTE_RX_SDU bulk data, which flows USB RX \u2192 do_rx() \u2192 gdm_lte_receive_pkt() \u2192 gdm_lte_netif_rx() \u2192 gdm_lte_rx() on every received SDU\u2014ordinary network traffic, not USB-descriptor framing.\nAC:L - Every successful receive that returns NET_RX_SUCCESS from netif_rx_ni() takes the else branch and dereferences skb-\u003elen after the skb has been consumed/freed by backlog softirq processing; the attacker only needs to deliver packets and needs no race or uncontrollable victim state.\nPR:N - Inbound LTE SDUs are processed with no host authentication, credentials, or capabilities; a remote network peer needs no OS account on the target.\nUI:N - Once the modem is attached and the lte*pdn* interfaces are up (typical always-on LTE/IoT deployment), packet delivery alone triggers the path with no mount, file-open, or other victim action.\nS:U - The use-after-free corrupts/uses host kernel skb/stats state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of the skb object after netif_rx_ni(); per scoring guidance a UAF enables heap reuse and arbitrary kernel memory disclosure (the freed skb-\u003elen read also feeds visible rx_bytes stats).\nI:H - Use-after-free of a slab skb is memory corruption that, under the higher-severity rule, is treated as enabling heap spray and write/control-flow hijack primitives in kernel context.\nA:H - Use-after-free of a consumed skb can oops/panic the kernel (and UAFs are scored A:H even when not fully exploited); a remote peer can retrigger it per received packet."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:38.698Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
        },
        {
          "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
        },
        {
          "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
        }
      ],
      "title": "staging: gdm724x: fix use after free in gdm_lte_rx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48851",
    "datePublished": "2024-07-16T12:25:18.488Z",
    "dateReserved": "2024-07-16T11:38:08.913Z",
    "dateUpdated": "2026-08-05T08:52:38.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48851",
      "date": "2026-09-18",
      "epss": "0.00513",
      "percentile": "0.42675"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C646FCEC-8D9D-4160-A402-1488A1906083",
                  "versionEndExcluding": "4.9.307",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7F0FA2C5-4E50-48A6-9D72-7C133B60EF05",
                  "versionEndExcluding": "4.14.272",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F8671D74-E8CD-4E41-A93F-3E3E88125D16",
                  "versionEndExcluding": "4.19.235",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B374BFBF-C879-4A72-921F-C850CF7DFB99",
                  "versionEndExcluding": "5.4.185",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6A4F38AC-99A2-48DF-B132-C9F785B309B8",
                  "versionEndExcluding": "5.10.106",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "15DC6588-B28F-4637-9A1E-3753B34A40CF",
                  "versionEndExcluding": "5.15.29",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "83FDEDF2-0E19-4879-91FD-171E66D1B335",
                  "versionEndExcluding": "5.16.15",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can\u0027t dereference it to\nsave the skb-\u003elen."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: staging: gdm724x: corrige el use after free en gdm_lte_rx() La funci\u00f3n netif_rx_ni() libera el skb para que no podamos desreferenciarlo para guardar el skb-\u0026gt;len."
        }
      ],
      "id": "CVE-2022-48851",
      "lastModified": "2024-11-21T07:34:12.727",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-07-16T13:15:12.247",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/gdm724x/gdm_lte.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6dc7b87c62423bfa68139fe95e85028aab584c9a",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83a9c886c2b5a0d28c0b37e1736b47f38d61332a",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "48ecdf3e29a6e514e8196691589c7dfc6c4ac169",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "403e3afe241b62401de1f8629c9c6b9b3d69dbff",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d9700b445098dbbce0caff4b8cfca214cf1e757",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fb9dd3787495b4deb0efe66c58306b65691a48f",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d39dc79513e99147b4c158a8a9e46743e23944f5",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc7f750dc9d102c1ed7bbe4591f991e770c99033",
                    "status": "affected",
                    "version": "61e121047645122c47714fcda684d0ee67f444af",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/gdm724x/gdm_lte.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.12"
                  },
                  {
                    "lessThan": "3.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.307",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.272",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.235",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.185",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.106",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.29",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.16.*",
                    "status": "unaffected",
                    "version": "5.16.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C646FCEC-8D9D-4160-A402-1488A1906083",
                    "versionEndExcluding": "4.9.307",
                    "versionStartIncluding": "3.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F0FA2C5-4E50-48A6-9D72-7C133B60EF05",
                    "versionEndExcluding": "4.14.272",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F8671D74-E8CD-4E41-A93F-3E3E88125D16",
                    "versionEndExcluding": "4.19.235",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B374BFBF-C879-4A72-921F-C850CF7DFB99",
                    "versionEndExcluding": "5.4.185",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A4F38AC-99A2-48DF-B132-C9F785B309B8",
                    "versionEndExcluding": "5.10.106",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15DC6588-B28F-4637-9A1E-3753B34A40CF",
                    "versionEndExcluding": "5.15.29",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83FDEDF2-0E19-4879-91FD-171E66D1B335",
                    "versionEndExcluding": "5.16.15",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can\u0027t dereference it to\nsave the skb-\u003elen."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: staging: gdm724x: corrige el use after free en gdm_lte_rx() La funci\u00f3n netif_rx_ni() libera el skb para que no podamos desreferenciarlo para guardar el skb-\u0026gt;len."
          }
        ],
        "id": "CVE-2022-48851",
        "lastModified": "2026-08-04T10:17:24.133",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48851",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:26:05.468000Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-07-16T13:15:12.247",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:44:54+00:00",
      "cve": "CVE-2022-48851",
      "id": "CVE-2022-48851",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: gdm724x: fix use after free in gdm_lte_rx()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48851.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:33:22Z",
      "cve": "CVE-2022-48851",
      "id": "CVE-2022-48851",
      "initial_release_date": "2024-07-18T03:05:38Z",
      "product_status:known_affected": "295",
      "product_status:known_not_affected": "490",
      "product_status:recommended": "511",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48851",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48851.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T15:25:01.775Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48851",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:26:05.468000Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:20.933Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/staging/gdm724x/gdm_lte.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "6dc7b87c62423bfa68139fe95e85028aab584c9a",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "83a9c886c2b5a0d28c0b37e1736b47f38d61332a",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "48ecdf3e29a6e514e8196691589c7dfc6c4ac169",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "403e3afe241b62401de1f8629c9c6b9b3d69dbff",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "6d9700b445098dbbce0caff4b8cfca214cf1e757",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "1fb9dd3787495b4deb0efe66c58306b65691a48f",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "d39dc79513e99147b4c158a8a9e46743e23944f5",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                },
                {
                  "lessThan": "fc7f750dc9d102c1ed7bbe4591f991e770c99033",
                  "status": "affected",
                  "version": "61e121047645122c47714fcda684d0ee67f444af",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/staging/gdm724x/gdm_lte.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.12"
                },
                {
                  "lessThan": "3.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.307",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.272",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.235",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.185",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.106",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.29",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.16.*",
                  "status": "unaffected",
                  "version": "5.16.15",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.307",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.272",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.235",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.185",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.106",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.29",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16.15",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17",
                      "versionStartIncluding": "3.12",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can\u0027t dereference it to\nsave the skb-\u003elen."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - gdm_lte_rx() is the RX completion path of the GDM724x LTE WWAN netdev; a remote peer that can deliver packets over the cellular/IP path causes the modem to submit LTE_RX_SDU bulk data, which flows USB RX \u2192 do_rx() \u2192 gdm_lte_receive_pkt() \u2192 gdm_lte_netif_rx() \u2192 gdm_lte_rx() on every received SDU\u2014ordinary network traffic, not USB-descriptor framing.\nAC:L - Every successful receive that returns NET_RX_SUCCESS from netif_rx_ni() takes the else branch and dereferences skb-\u003elen after the skb has been consumed/freed by backlog softirq processing; the attacker only needs to deliver packets and needs no race or uncontrollable victim state.\nPR:N - Inbound LTE SDUs are processed with no host authentication, credentials, or capabilities; a remote network peer needs no OS account on the target.\nUI:N - Once the modem is attached and the lte*pdn* interfaces are up (typical always-on LTE/IoT deployment), packet delivery alone triggers the path with no mount, file-open, or other victim action.\nS:U - The use-after-free corrupts/uses host kernel skb/stats state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of the skb object after netif_rx_ni(); per scoring guidance a UAF enables heap reuse and arbitrary kernel memory disclosure (the freed skb-\u003elen read also feeds visible rx_bytes stats).\nI:H - Use-after-free of a slab skb is memory corruption that, under the higher-severity rule, is treated as enabling heap spray and write/control-flow hijack primitives in kernel context.\nA:H - Use-after-free of a consumed skb can oops/panic the kernel (and UAFs are scored A:H even when not fully exploited); a remote peer can retrigger it per received packet."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:52:38.698Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"
            },
            {
              "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"
            },
            {
              "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"
            },
            {
              "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"
            },
            {
              "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"
            },
            {
              "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"
            },
            {
              "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"
            },
            {
              "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"
            }
          ],
          "title": "staging: gdm724x: fix use after free in gdm_lte_rx()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48851",
        "datePublished": "2024-07-16T12:25:18.488Z",
        "dateReserved": "2024-07-16T11:38:08.913Z",
        "dateUpdated": "2026-08-05T08:52:38.698Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.