Linux Kernel up to 6.0.9 netlink net/netlink/af_netlink.c memcpy memory corruption

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.0.9. It has been declared as critical. This vulnerability affects the function memcpy of the file net/netlink/af_netlink.c of the component netlink. Such manipulation leads to memory corruption. This vulnerability is traded as CVE-2022-49766. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.0.9 and classified as critical. Affected by this issue is the function memcpy of the file net/netlink/af_netlink.c of the component netlink. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: netlink: Bounds-check struct nlmsgerr creation In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(), switch from __nlmsg_put to nlmsg_put(), and explain the bounds check for dealing with the memcpy() across a composite flexible array struct. Avoids this future run-time warning: memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2022-49766 since 04/16/2025. The exploitation is known to be easy. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/07/2025).

The vulnerability scanner Nessus provides a plugin with the ID 250155 (Linux Distros Unpatched Vulnerability : CVE-2022-49766), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.0.10 eliminates this vulnerability. Applying the patch aff4eb16f589c3af322a2582044bca365381fcd6/710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (250155). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion