CVE-2022-49997CWE-401

CVE-2022-49997

High · published June 18, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: lantiq_xrx200: restore buffer if memory allocation failed

In a situation where memory allocation fails, an invalid buffer address

is stored. When this descriptor is used again, the system panics in the

build_skb() function when accessing memory.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-06-18T15:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 5.4.128, < 5.55.5
linux/linux_kernel≥ 5.10.46, < 5.115.11
linux/linux_kernel≥ 5.12.13, < 5.135.13
linux/linux_kernel≥ 5.13.1, < 5.19.65.19.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 18 JUN 11:00Z
    net: lantiq_xrx200: restore buffer if memory allocation failed
    cvelistv5