---
id: CVE-2022-49975
title: 'bpf: Don''t redirect packets with invalid pkt_len'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Don't redirect packets with invalid pkt_len

  Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any
  skbs, that is, the flow->head is null.
  The r…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 <
    8b68e53d56697a59b5c53893b53f508bbdf272a0
  - >-
    Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 <
    6204bf78b2a903b96ba43afff6abc0b04d6e0462
  - >-
    Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 <
    a75987714bd2d8e59840667a28e15c1fa5c47554
  - >-
    Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 <
    72f2dc8993f10262092745a88cb2dd0fef094f23
  - >-
    Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 <
    fd1894224407c484f652ad456e1ce423e89bb3eb
  - Linux 4.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:52:21.290958Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:12.903Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49975'
references:
  - url: 'https://git.kernel.org/stable/c/8b68e53d56697a59b5c53893b53f508bbdf272a0'
  - url: 'https://git.kernel.org/stable/c/6204bf78b2a903b96ba43afff6abc0b04d6e0462'
  - url: 'https://git.kernel.org/stable/c/a75987714bd2d8e59840667a28e15c1fa5c47554'
  - url: 'https://git.kernel.org/stable/c/72f2dc8993f10262092745a88cb2dd0fef094f23'
  - url: 'https://git.kernel.org/stable/c/fd1894224407c484f652ad456e1ce423e89bb3eb'
tags:
  - cve.org
epss: 0.00266
epssPercentile: 0.1861
ingestedAt: '2026-11-05T22:38:31.631Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't redirect packets with invalid pkt_len

Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any
skbs, that is, the flow->head is null.
The root cause, as the [2] says, is because that bpf_prog_test_run_skb()
run a bpf prog which redirects empty skbs.
So we should determine whether the length of the packet modified by bpf
prog or others like bpf_prog_test is valid before forwarding it directly.

## Affected

- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 8b68e53d56697a59b5c53893b53f508bbdf272a0`
- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 6204bf78b2a903b96ba43afff6abc0b04d6e0462`
- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < a75987714bd2d8e59840667a28e15c1fa5c47554`
- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < 72f2dc8993f10262092745a88cb2dd0fef094f23`
- `Linux >= 5293efe62df81908f2e90c9820c7edcc8e61f5e9 < fd1894224407c484f652ad456e1ce423e89bb3eb`
- `Linux 4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.