GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49664 (GCVE-0-2022-49664)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:23 – Updated: 2026-08-05 08:55
VLAI
Title
tipc: move bc link creation back to tipc_node_create
Summary
In the Linux kernel, the following vulnerability has been resolved: tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] [] Call Trace: [] <IRQ> [] tipc_bcast_rcv+0xa2/0x190 [tipc] [] tipc_node_bc_rcv+0x8b/0x200 [tipc] [] tipc_rcv+0x3af/0x5b0 [tipc] [] tipc_udp_recv+0xc7/0x1e0 [tipc] It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it creates a node in tipc_node_check_dest(), after inserting the new node into hashtable in tipc_node_create(), it creates the bc link. However, there is a gap between this insert and bc link creation, a bc packet may come in and get the node from the hashtable then try to dereference its bc link, which is NULL. This patch is to fix it by moving the bc link creation before inserting into the hashtable. Note that for a preliminary node becoming "real", the bc link creation should also be called before it's rehashed, as we don't create it for preliminary nodes.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:33 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 , < 456bc338871c4a52117dd5ef29cce3745456d248 (git)
Affected: 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 , < 35fcb2ba35b4d9b592b558c3bcc6e0d90e213588 (git)
Affected: 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 , < e52910e671f58c619e33dac476b11b35e2d3ab6f (git)
Affected: 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 , < cb8092d70a6f5f01ec1490fce4d35efed3ed996c (git)
Affected: 0b8f0026bbd4df1688e1726026476e60762daf2a (git)
Affected: 5.4.287 , < 5.5 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.129 , ≤ 5.10.* (semver)
Unaffected: 5.15.53 , ≤ 5.15.* (semver)
Unaffected: 5.18.10 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:33:28.247716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:47.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "456bc338871c4a52117dd5ef29cce3745456d248",
              "status": "affected",
              "version": "4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4",
              "versionType": "git"
            },
            {
              "lessThan": "35fcb2ba35b4d9b592b558c3bcc6e0d90e213588",
              "status": "affected",
              "version": "4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4",
              "versionType": "git"
            },
            {
              "lessThan": "e52910e671f58c619e33dac476b11b35e2d3ab6f",
              "status": "affected",
              "version": "4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4",
              "versionType": "git"
            },
            {
              "lessThan": "cb8092d70a6f5f01ec1490fce4d35efed3ed996c",
              "status": "affected",
              "version": "4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b8f0026bbd4df1688e1726026476e60762daf2a",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.287",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.129",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.53",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.10",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.287",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: move bc link creation back to tipc_node_create\n\nShuang Li reported a NULL pointer dereference crash:\n\n  [] BUG: kernel NULL pointer dereference, address: 0000000000000068\n  [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc]\n  [] Call Trace:\n  []  \u003cIRQ\u003e\n  []  tipc_bcast_rcv+0xa2/0x190 [tipc]\n  []  tipc_node_bc_rcv+0x8b/0x200 [tipc]\n  []  tipc_rcv+0x3af/0x5b0 [tipc]\n  []  tipc_udp_recv+0xc7/0x1e0 [tipc]\n\nIt was caused by the \u0027l\u0027 passed into tipc_bcast_rcv() is NULL. When it\ncreates a node in tipc_node_check_dest(), after inserting the new node\ninto hashtable in tipc_node_create(), it creates the bc link. However,\nthere is a gap between this insert and bc link creation, a bc packet\nmay come in and get the node from the hashtable then try to dereference\nits bc link, which is NULL.\n\nThis patch is to fix it by moving the bc link creation before inserting\ninto the hashtable.\n\nNote that for a preliminary node becoming \"real\", the bc link creation\nshould also be called before it\u0027s rehashed, as we don\u0027t create it for\npreliminary nodes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The crash path is tipc_udp_recv \u2192 tipc_rcv \u2192 tipc_node_bc_rcv \u2192 tipc_bcast_rcv, processing TIPC-over-UDP packets (default port 6118) from remote IP peers across routed networks; analogous TIPC packet bugs (e.g. CVE-2022-0435) are scored Network.\nAC:L - The attacker controls both sides of the race by sending a LINK_CONFIG discovery packet to create/insert the node and concurrently flooding broadcast packets that look up that node before bc_entry.link is allocated.\nPR:N - Once a TIPC bearer is enabled, discovery and broadcast receive paths require no authentication or credentials (crypto is optional; only a matching net_id, default 4711, is checked), so a remote unauthenticated peer can trigger the bug.\nUI:N - Exploitation requires only sending crafted TIPC packets; no victim user action is needed.\nS:U - Impact is a kernel oops within the same host security authority; this is not a VM/IOMMU/sandbox escape.\nC:N - The bug is a pure NULL dereference of bc_entry.link in tipc_link_is_up()/link_is_up(); it does not yield an information-disclosure primitive.\nI:N - The NULL pointer dereference causes an immediate crash with no memory corruption write or control-flow hijack primitive.\nA:H - Dereferencing the NULL broadcast link causes a kernel NULL pointer dereference oops/panic, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:57.231Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248"
        },
        {
          "url": "https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588"
        },
        {
          "url": "https://git.kernel.org/stable/c/e52910e671f58c619e33dac476b11b35e2d3ab6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996c"
        }
      ],
      "title": "tipc: move bc link creation back to tipc_node_create",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49664",
    "datePublished": "2025-02-26T02:23:59.792Z",
    "dateReserved": "2025-02-26T02:21:30.435Z",
    "dateUpdated": "2026-08-05T08:55:57.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49664",
      "date": "2026-09-15",
      "epss": "0.00693",
      "percentile": "0.51025"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49664\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:41.420\",\"lastModified\":\"2026-08-04T10:17:53.217\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: move bc link creation back to tipc_node_create\\n\\nShuang Li reported a NULL pointer dereference crash:\\n\\n  [] BUG: kernel NULL pointer dereference, address: 0000000000000068\\n  [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc]\\n  [] Call Trace:\\n  []  \u003cIRQ\u003e\\n  []  tipc_bcast_rcv+0xa2/0x190 [tipc]\\n  []  tipc_node_bc_rcv+0x8b/0x200 [tipc]\\n  []  tipc_rcv+0x3af/0x5b0 [tipc]\\n  []  tipc_udp_recv+0xc7/0x1e0 [tipc]\\n\\nIt was caused by the \u0027l\u0027 passed into tipc_bcast_rcv() is NULL. When it\\ncreates a node in tipc_node_check_dest(), after inserting the new node\\ninto hashtable in tipc_node_create(), it creates the bc link. However,\\nthere is a gap between this insert and bc link creation, a bc packet\\nmay come in and get the node from the hashtable then try to dereference\\nits bc link, which is NULL.\\n\\nThis patch is to fix it by moving the bc link creation before inserting\\ninto the hashtable.\\n\\nNote that for a preliminary node becoming \\\"real\\\", the bc link creation\\nshould also be called before it\u0027s rehashed, as we don\u0027t create it for\\npreliminary nodes.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tipc: mover la creaci\u00f3n del enlace bc de nuevo a tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] [] Call Trace: []  [] tipc_bcast_rcv+0xa2/0x190 [tipc] [] tipc_node_bc_rcv+0x8b/0x200 [tipc] [] tipc_rcv+0x3af/0x5b0 [tipc] [] tipc_udp_recv+0xc7/0x1e0 [tipc] It was caused by the \u0027l\u0027 passed into tipc_bcast_rcv() is NULL. Cuando crea un nodo en tipc_node_check_dest(), despu\u00e9s de insertar el nuevo nodo en la tabla hash en tipc_node_create(), crea el enlace bc. Sin embargo, hay una brecha entre esta inserci\u00f3n y la creaci\u00f3n del enlace bc, un paquete bc puede llegar y obtener el nodo de la tabla hash y luego intentar desreferenciar su enlace bc, que es NULL. Este parche es para solucionarlo moviendo la creaci\u00f3n del enlace bc antes de insertarlo en la tabla hash. Tenga en cuenta que para que un nodo preliminar se vuelva \\\"real\\\", la creaci\u00f3n del enlace bc tambi\u00e9n debe llamarse antes de que se vuelva a crear, ya que no lo creamos para los nodos preliminares.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/tipc/node.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\",\"lessThan\":\"456bc338871c4a52117dd5ef29cce3745456d248\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\",\"lessThan\":\"35fcb2ba35b4d9b592b558c3bcc6e0d90e213588\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\",\"lessThan\":\"e52910e671f58c619e33dac476b11b35e2d3ab6f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\",\"lessThan\":\"cb8092d70a6f5f01ec1490fce4d35efed3ed996c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b8f0026bbd4df1688e1726026476e60762daf2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.287\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/tipc/node.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.129\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.53\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.10\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:33:28.247716Z\",\"id\":\"CVE-2022-49664\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.287\",\"versionEndExcluding\":\"5.10.129\",\"matchCriteriaId\":\"2CED68CD-DF2D-4A28-BAB6-F04A71D588FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.53\",\"matchCriteriaId\":\"70DCF327-F4B6-4CDB-8C9E-98E909E60127\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.10\",\"matchCriteriaId\":\"8261A22B-B156-4045-AE8E-AA9E95E7930C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF8547FC-C849-4F1B-804B-A93AE2F04A92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3068028-F453-4A1C-B80F-3F5609ACEF60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E9C0DB0-D349-489F-A3D6-B77214E93A8A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e52910e671f58c619e33dac476b11b35e2d3ab6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:14:42+00:00",
      "cve": "CVE-2022-49664",
      "id": "CVE-2022-49664",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "286",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tipc: move bc link creation back to tipc_node_create",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49664.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:29:42Z",
      "cve": "CVE-2022-49664",
      "id": "CVE-2022-49664",
      "initial_release_date": "2025-02-27T03:03:14Z",
      "product_status:known_affected": "61",
      "product_status:known_not_affected": "408",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49664",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49664.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49664\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:33:28.247716Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:52:49.331Z\"}}], \"cna\": {\"title\": \"tipc: move bc link creation back to tipc_node_create\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\", \"lessThan\": \"456bc338871c4a52117dd5ef29cce3745456d248\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\", \"lessThan\": \"35fcb2ba35b4d9b592b558c3bcc6e0d90e213588\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\", \"lessThan\": \"e52910e671f58c619e33dac476b11b35e2d3ab6f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4\", \"lessThan\": \"cb8092d70a6f5f01ec1490fce4d35efed3ed996c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0b8f0026bbd4df1688e1726026476e60762daf2a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.4.287\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/tipc/node.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.129\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.53\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/tipc/node.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248\"}, {\"url\": \"https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588\"}, {\"url\": \"https://git.kernel.org/stable/c/e52910e671f58c619e33dac476b11b35e2d3ab6f\"}, {\"url\": \"https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: move bc link creation back to tipc_node_create\\n\\nShuang Li reported a NULL pointer dereference crash:\\n\\n  [] BUG: kernel NULL pointer dereference, address: 0000000000000068\\n  [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc]\\n  [] Call Trace:\\n  []  \u003cIRQ\u003e\\n  []  tipc_bcast_rcv+0xa2/0x190 [tipc]\\n  []  tipc_node_bc_rcv+0x8b/0x200 [tipc]\\n  []  tipc_rcv+0x3af/0x5b0 [tipc]\\n  []  tipc_udp_recv+0xc7/0x1e0 [tipc]\\n\\nIt was caused by the \u0027l\u0027 passed into tipc_bcast_rcv() is NULL. When it\\ncreates a node in tipc_node_check_dest(), after inserting the new node\\ninto hashtable in tipc_node_create(), it creates the bc link. However,\\nthere is a gap between this insert and bc link creation, a bc packet\\nmay come in and get the node from the hashtable then try to dereference\\nits bc link, which is NULL.\\n\\nThis patch is to fix it by moving the bc link creation before inserting\\ninto the hashtable.\\n\\nNote that for a preliminary node becoming \\\"real\\\", the bc link creation\\nshould also be called before it\u0027s rehashed, as we don\u0027t create it for\\npreliminary nodes.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.129\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.53\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.10\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.287\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:22:41.505Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49664\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:22:41.505Z\", \"dateReserved\": \"2025-02-26T02:21:30.435Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:23:59.792Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.