{"id":"CVE-2022-49975","title":"bpf: Don't redirect packets with invalid pkt_len","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't redirect packets with invalid pkt_len\n\nSyzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any\nskbs, that is, the flow->head is null.\nThe r…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 8b68e53d56697a59b5c53893b53f508bbdf272a0","Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 6204bf78b2a903b96ba43afff6abc0b04d6e0462","Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < a75987714bd2d8e59840667a28e15c1fa5c47554","Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 72f2dc8993f10262092745a88cb2dd0fef094f23","Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < fd1894224407c484f652ad456e1ce423e89bb3eb","Linux 4.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:52:21.290958Z"},"published":"2025-06-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:00:12.903Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49975","references":[{"url":"https://git.kernel.org/stable/c/8b68e53d56697a59b5c53893b53f508bbdf272a0"},{"url":"https://git.kernel.org/stable/c/6204bf78b2a903b96ba43afff6abc0b04d6e0462"},{"url":"https://git.kernel.org/stable/c/a75987714bd2d8e59840667a28e15c1fa5c47554"},{"url":"https://git.kernel.org/stable/c/72f2dc8993f10262092745a88cb2dd0fef094f23"},{"url":"https://git.kernel.org/stable/c/fd1894224407c484f652ad456e1ce423e89bb3eb"}],"tags":["cve.org"],"epss":0.00266,"epssPercentile":0.1861,"ingestedAt":"2026-11-05T22:38:31.631Z","slug":"CVE-2022-49975","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't redirect packets with invalid pkt_len\n\nSyzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any\nskbs, that is, the flow->head is null.\nThe root cause, as the [2] says, is because that bpf_prog_test_run_skb()\nrun a bpf prog which redirects empty skbs.\nSo we should determine whether the length of the packet modified by bpf\nprog or others like bpf_prog_test is valid before forwarding it directly.\n\n## Affected\n\n- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 8b68e53d56697a59b5c53893b53f508bbdf272a0`\n- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 6204bf78b2a903b96ba43afff6abc0b04d6e0462`\n- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < a75987714bd2d8e59840667a28e15c1fa5c47554`\n- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 72f2dc8993f10262092745a88cb2dd0fef094f23`\n- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < fd1894224407c484f652ad456e1ce423e89bb3eb`\n- `Linux 4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}