CVE-2022-49269 can: isotp: sanitize CAN ID checks in isotp_bind()
A flaw in the Linux kernel CAN subsystem allows attackers to trigger an invalid state machine status, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49269?
CVE-2022-49269 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: sanitize CAN ID checks in isotp_bind()
Syzbot created an environment that lead to a state machine status that can not be reached with a compliant CAN ID address configuration. The provided address information consisted of CAN ID 0x6000001 and 0xC28001 which both boil down to 11 bit CAN IDs 0x001 in sending and receiving.
Sanitize the SFF/EFF CAN ID values before performing the address checks.
Which versions are affected by CVE-2022-49269?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49269?
Apply the vendor's patch.
Is CVE-2022-49269 being exploited?
There is no known exploitation of CVE-2022-49269 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49269, GHSA-39ww-6ww3-69g8, UBUNTU-CVE-2022-49269.