{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-49812 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-49812 is a medium-severity memory corruption vulnerability in Linux kernel, published on 1 May 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-49812 and fix it if it is affected.\n\nWhat it is: CVE-2022-49812 is a medium-severity memory corruption vulnerability in Linux kernel, published on 1 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-49812 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-49812/ (Markdown: https://insights.sbomify.com/CVE-2022-49812/index.md)","id":"CVE-2022-49812","markdown":"https://insights.sbomify.com/CVE-2022-49812/index.md","name":"CVE-2022-49812","record":{"aliases":["DEBIAN-CVE-2022-49812","GHSA-9x8c-4rx4-5mxv","UBUNTU-CVE-2022-49812"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel bridge","requires_auth":"low_privilege","summary":"A memory leak in the Linux kernel bridge driver allows attackers to cause denial of service by repeatedly changing VLAN protocols.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: switchdev: Fix memory leaks when changing VLAN protocol\n\nThe bridge driver can offload VLANs to the underlying hardware either\nvia switchdev or the 8021q driver. When the former is used, the VLAN is\nmarked in the bridge driver with the 'BR_VLFLAG_ADDED_BY_SWITCHDEV'\nprivate flag.\n\nTo avoid the memory leaks mentioned in the cited commit, the bridge\ndriver will try to delete a VLAN via the 8021q driver if the VLAN is not\nmarked with the previously mentioned flag.\n\nWhen the VLAN protocol of the bridge changes, switchdev drivers are\nnotified via the 'SWITCHDEV_ATTR_ID_BRIDGE_VLAN_PROTOCOL' attribute, but\nthe 8021q driver is also called to add the existing VLANs with the new\nprotocol and delete them with the old protocol.\n\nIn case the VLANs were offloaded via switchdev, the above behavior is\nboth redundant and buggy. Redundant because the VLANs are already\nprogrammed in hardware and drivers that support VLAN protocol change\n(currently only mlx5) change the protocol upon the switchdev attribute\nnotification. Buggy because the 8021q driver is called despite these\nVLANs being marked with 'BR_VLFLAG_ADDED_BY_SWITCHDEV'. This leads to\nmemory leaks [1] when the VLANs are deleted.\n\nFix by not calling the 8021q driver for VLANs that were already\nprogrammed via switchdev.\n\n[1]\nunreferenced object 0xffff8881f6771200 (size 256):\n  comm \"ip\", pid 446855, jiffies 4298238841 (age 55.240s)\n  hex dump (first 32 bytes):\n    00 00 7f 0e 83 88 ff ff 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [\u003c00000000012819ac\u003e] vlan_vid_add+0x437/0x750\n    [\u003c00000000f2281fad\u003e] __br_vlan_set_proto+0x289/0x920\n    [\u003c000000000632b56f\u003e] br_changelink+0x3d6/0x13f0\n    [\u003c0000000089d25f04\u003e] __rtnl_newlink+0x8ae/0x14c0\n    [\u003c00000000f6276baf\u003e] rtnl_newlink+0x5f/0x90\n    [\u003c00000000746dc902\u003e] rtnetlink_rcv_msg+0x336/0xa00\n    [\u003c000000001c2241c0\u003e] netlink_rcv_skb+0x11d/0x340\n    [\u003c0000000010588814\u003e] netlink_unicast+0x438/0x710\n    [\u003c00000000e1a4cd5c\u003e] netlink_sendmsg+0x788/0xc40\n    [\u003c00000000e8992d4e\u003e] sock_sendmsg+0xb0/0xe0\n    [\u003c00000000621b8f91\u003e] ____sys_sendmsg+0x4ff/0x6d0\n    [\u003c000000000ea26996\u003e] ___sys_sendmsg+0x12e/0x1b0\n    [\u003c00000000684f7e25\u003e] __sys_sendmsg+0xab/0x130\n    [\u003c000000004538b104\u003e] do_syscall_64+0x3d/0x90\n    [\u003c0000000091ed9678\u003e] entry_SYSCALL_64_after_hwframe+0x46/0xb0","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bridge: switchdev: Fix memory leaks when changing VLAN protocol","id":"CVE-2022-49812","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"memory_corruption","year":"2022"},"n_packages":0,"n_references":4,"next":{"headline":"net: ena: Fix error handling in ena_init()","id":"CVE-2022-49813"},"packages":[],"prev":{"headline":"drbd: use after free in drbd_create_device()","id":"CVE-2022-49811"},"products":["Linux"],"published":"2025-05-01","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A memory leak in the Linux kernel bridge driver allows attackers to cause denial of service by repeatedly changing VLAN protocols.","url":"https://insights.sbomify.com/CVE-2022-49812/"}