CVE-2022-48748

net: bridge: vlan: fix memory leak in __allowed_ingress

High · published June 20, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: vlan: fix memory leak in __allowed_ingress

When using per-vlan state, if vlan snooping and stats are disabled,

untagged or priority-tagged ingress frame will go to check pvid state.

If the port state is forwarding and the pvid state is not

learning/forwarding, untagged or priority-tagged frame will be dropped

but skb memory is not freed.

Should free skb when __allowed_ingress returns false.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01128 · 66.1th percentile
Published
2024-06-20T11:13Z
EPSS history
Timeline
  • 20 JUN 11:13Z
    net: bridge: vlan: fix memory leak in __allowed_ingress
    cvelistv5