GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49142 (GCVE-0-2022-49142)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-08-05 08:54
VLAI
Title
net: preserve skb_end_offset() in skb_unclone_keeptruesize()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: preserve skb_end_offset() in skb_unclone_keeptruesize() syzbot found another way to trigger the infamous WARN_ON_ONCE(delta < len) in skb_try_coalesce() [1] I was able to root cause the issue to kfence. When kfence is in action, the following assertion is no longer true: int size = xxxx; void *ptr1 = kmalloc(size, gfp); void *ptr2 = kmalloc(size, gfp); if (ptr1 && ptr2) ASSERT(ksize(ptr1) == ksize(ptr2)); We attempted to fix these issues in the blamed commits, but forgot that TCP was possibly shifting data after skb_unclone_keeptruesize() has been used, notably from tcp_retrans_try_collapse(). So we not only need to keep same skb->truesize value, we also need to make sure TCP wont fill new tailroom that pskb_expand_head() was able to get from a addr = kmalloc(...) followed by ksize(addr) Split skb_unclone_keeptruesize() into two parts: 1) Inline skb_unclone_keeptruesize() for the common case, when skb is not cloned. 2) Out of line __skb_unclone_keeptruesize() for the 'slow path'. WARNING: CPU: 1 PID: 6490 at net/core/skbuff.c:5295 skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295 Modules linked in: CPU: 1 PID: 6490 Comm: syz-executor161 Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295 Code: bf 01 00 00 00 0f b7 c0 89 c6 89 44 24 20 e8 62 24 4e fa 8b 44 24 20 83 e8 01 0f 85 e5 f0 ff ff e9 87 f4 ff ff e8 cb 20 4e fa <0f> 0b e9 06 f9 ff ff e8 af b2 95 fa e9 69 f0 ff ff e8 95 b2 95 fa RSP: 0018:ffffc900063af268 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 00000000ffffffd5 RCX: 0000000000000000 RDX: ffff88806fc05700 RSI: ffffffff872abd55 RDI: 0000000000000003 RBP: ffff88806e675500 R08: 00000000ffffffd5 R09: 0000000000000000 R10: ffffffff872ab659 R11: 0000000000000000 R12: ffff88806dd554e8 R13: ffff88806dd9bac0 R14: ffff88806dd9a2c0 R15: 0000000000000155 FS: 00007f18014f9700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002000 CR3: 000000006be7a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_try_coalesce net/ipv4/tcp_input.c:4651 [inline] tcp_try_coalesce+0x393/0x920 net/ipv4/tcp_input.c:4630 tcp_queue_rcv+0x8a/0x6e0 net/ipv4/tcp_input.c:4914 tcp_data_queue+0x11fd/0x4bb0 net/ipv4/tcp_input.c:5025 tcp_rcv_established+0x81e/0x1ff0 net/ipv4/tcp_input.c:5947 tcp_v4_do_rcv+0x65e/0x980 net/ipv4/tcp_ipv4.c:1719 sk_backlog_rcv include/net/sock.h:1037 [inline] __release_sock+0x134/0x3b0 net/core/sock.c:2779 release_sock+0x54/0x1b0 net/core/sock.c:3311 sk_wait_data+0x177/0x450 net/core/sock.c:2821 tcp_recvmsg_locked+0xe28/0x1fd0 net/ipv4/tcp.c:2457 tcp_recvmsg+0x137/0x610 net/ipv4/tcp.c:2572 inet_recvmsg+0x11b/0x5e0 net/ipv4/af_inet.c:850 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 097b9146c0e26aabaa6ff3e5ea536a53f5254a79 , < 23629b673b780d967b88a850b1518cf0f0ffc6aa (git)
Affected: 097b9146c0e26aabaa6ff3e5ea536a53f5254a79 , < a9a6d30264327d8ff7f23da33e7a77ffb793fa3f (git)
Affected: 097b9146c0e26aabaa6ff3e5ea536a53f5254a79 , < a903e516f5df44b46d526b403d93e7be1a425538 (git)
Affected: 097b9146c0e26aabaa6ff3e5ea536a53f5254a79 , < 2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01 (git)
Affected: 7118945cdf0d4b5a76eb4f5f330ac6f48d372025 (git)
Affected: ec697f7f3f6a89d4dd1af113587d0330b5a033e8 (git)
Affected: 7582edf28f5d1f0a4d2f7abdb7d9560d09fd41b5 (git)
Affected: 5d55a6a46a7f70bc1d270c50200edd3096cb380c (git)
Affected: e6af7cb64b7b37b8a371acdbe33a636496ffb5a4 (git)
Affected: 97ff09a7ed484fef2b1bbc103857444b7332fca8 (git)
Affected: bf5a58d143d7899d2c89e585be6e98ec81fe9683 (git)
Affected: 4.4.260 , < 4.5 (semver)
Affected: 4.9.260 , < 4.10 (semver)
Affected: 4.14.224 , < 4.15 (semver)
Affected: 4.19.179 , < 4.20 (semver)
Affected: 5.4.103 , < 5.5 (semver)
Affected: 5.10.21 , < 5.11 (semver)
Affected: 5.11.4 , < 5.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23629b673b780d967b88a850b1518cf0f0ffc6aa",
              "status": "affected",
              "version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
              "versionType": "git"
            },
            {
              "lessThan": "a9a6d30264327d8ff7f23da33e7a77ffb793fa3f",
              "status": "affected",
              "version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
              "versionType": "git"
            },
            {
              "lessThan": "a903e516f5df44b46d526b403d93e7be1a425538",
              "status": "affected",
              "version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
              "versionType": "git"
            },
            {
              "lessThan": "2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01",
              "status": "affected",
              "version": "097b9146c0e26aabaa6ff3e5ea536a53f5254a79",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7118945cdf0d4b5a76eb4f5f330ac6f48d372025",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec697f7f3f6a89d4dd1af113587d0330b5a033e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7582edf28f5d1f0a4d2f7abdb7d9560d09fd41b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d55a6a46a7f70bc1d270c50200edd3096cb380c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e6af7cb64b7b37b8a371acdbe33a636496ffb5a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "97ff09a7ed484fef2b1bbc103857444b7332fca8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bf5a58d143d7899d2c89e585be6e98ec81fe9683",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.260",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.260",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.224",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.179",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.103",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.21",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.260",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.260",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.224",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.179",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: preserve skb_end_offset() in skb_unclone_keeptruesize()\n\nsyzbot found another way to trigger the infamous WARN_ON_ONCE(delta \u003c len)\nin skb_try_coalesce() [1]\n\nI was able to root cause the issue to kfence.\n\nWhen kfence is in action, the following assertion is no longer true:\n\nint size = xxxx;\nvoid *ptr1 = kmalloc(size, gfp);\nvoid *ptr2 = kmalloc(size, gfp);\n\nif (ptr1 \u0026\u0026 ptr2)\n\tASSERT(ksize(ptr1) == ksize(ptr2));\n\nWe attempted to fix these issues in the blamed commits, but forgot\nthat TCP was possibly shifting data after skb_unclone_keeptruesize()\nhas been used, notably from tcp_retrans_try_collapse().\n\nSo we not only need to keep same skb-\u003etruesize value,\nwe also need to make sure TCP wont fill new tailroom\nthat pskb_expand_head() was able to get from a\naddr = kmalloc(...) followed by ksize(addr)\n\nSplit skb_unclone_keeptruesize() into two parts:\n\n1) Inline skb_unclone_keeptruesize() for the common case,\n   when skb is not cloned.\n\n2) Out of line __skb_unclone_keeptruesize() for the \u0027slow path\u0027.\n\nWARNING: CPU: 1 PID: 6490 at net/core/skbuff.c:5295 skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295\nModules linked in:\nCPU: 1 PID: 6490 Comm: syz-executor161 Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295\nCode: bf 01 00 00 00 0f b7 c0 89 c6 89 44 24 20 e8 62 24 4e fa 8b 44 24 20 83 e8 01 0f 85 e5 f0 ff ff e9 87 f4 ff ff e8 cb 20 4e fa \u003c0f\u003e 0b e9 06 f9 ff ff e8 af b2 95 fa e9 69 f0 ff ff e8 95 b2 95 fa\nRSP: 0018:ffffc900063af268 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: 00000000ffffffd5 RCX: 0000000000000000\nRDX: ffff88806fc05700 RSI: ffffffff872abd55 RDI: 0000000000000003\nRBP: ffff88806e675500 R08: 00000000ffffffd5 R09: 0000000000000000\nR10: ffffffff872ab659 R11: 0000000000000000 R12: ffff88806dd554e8\nR13: ffff88806dd9bac0 R14: ffff88806dd9a2c0 R15: 0000000000000155\nFS:  00007f18014f9700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020002000 CR3: 000000006be7a000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n tcp_try_coalesce net/ipv4/tcp_input.c:4651 [inline]\n tcp_try_coalesce+0x393/0x920 net/ipv4/tcp_input.c:4630\n tcp_queue_rcv+0x8a/0x6e0 net/ipv4/tcp_input.c:4914\n tcp_data_queue+0x11fd/0x4bb0 net/ipv4/tcp_input.c:5025\n tcp_rcv_established+0x81e/0x1ff0 net/ipv4/tcp_input.c:5947\n tcp_v4_do_rcv+0x65e/0x980 net/ipv4/tcp_ipv4.c:1719\n sk_backlog_rcv include/net/sock.h:1037 [inline]\n __release_sock+0x134/0x3b0 net/core/sock.c:2779\n release_sock+0x54/0x1b0 net/core/sock.c:3311\n sk_wait_data+0x177/0x450 net/core/sock.c:2821\n tcp_recvmsg_locked+0xe28/0x1fd0 net/ipv4/tcp.c:2457\n tcp_recvmsg+0x137/0x610 net/ipv4/tcp.c:2572\n inet_recvmsg+0x11b/0x5e0 net/ipv4/af_inet.c:850\n sock_recvmsg_nosec net/socket.c:948 [inline]\n sock_recvmsg net/socket.c:966 [inline]\n sock_recvmsg net/socket.c:962 [inline]\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable skb_unclone_keeptruesize() path is reached while processing peer TCP behavior\u2014incoming SACKs/ACKs drive skb_prepare_for_shift/tcp_trim_head, and withheld ACKs drive retransmit collapse\u2014so a remote TCP peer can trigger it against a data-sending service.\nAC:L - The attacker controls connection traffic (SACK patterns, ACK withholding, retransmit pressure) that drives the unclone and collapse sequences; under a KFENCE-enabled deployment they can retry until a sampled allocation produces the size mismatch.\nPR:N - No privileges or authentication are required\u2014only an unauthenticated TCP session to a service that sends data (for example an internet-facing server), after which crafted peer packets exercise the vulnerable path.\nUI:N - Exploitation needs no victim user action beyond the already-running network service accepting and sending on the TCP connection.\nS:U - Impact stays within the same kernel networking authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:N - The bug desynchronizes skb accounting metadata and trips WARN_ON_ONCE in skb_try_coalesce; it does not provide a usable kernel memory read or info-disclosure primitive.\nI:N - Extra tailroom comes from a legitimately larger kmalloc/ksize allocation rather than an out-of-bounds write or UAF, so there is no practical arbitrary-write or control-flow hijack primitive.\nA:H - The desync triggers WARN_ON_ONCE(delta \u003c len) (crash under panic_on_warn) and corrupts sk_buff/socket memory accounting, enabling connection or host denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:03.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23629b673b780d967b88a850b1518cf0f0ffc6aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9a6d30264327d8ff7f23da33e7a77ffb793fa3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a903e516f5df44b46d526b403d93e7be1a425538"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01"
        }
      ],
      "title": "net: preserve skb_end_offset() in skb_unclone_keeptruesize()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49142",
    "datePublished": "2025-02-26T01:55:12.823Z",
    "dateReserved": "2025-02-26T01:49:39.269Z",
    "dateUpdated": "2026-08-05T08:54:03.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49142",
      "date": "2026-09-15",
      "epss": "0.00631",
      "percentile": "0.48419"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49142\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:51.420\",\"lastModified\":\"2026-08-04T10:17:36.273\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: preserve skb_end_offset() in skb_unclone_keeptruesize()\\n\\nsyzbot found another way to trigger the infamous WARN_ON_ONCE(delta \u003c len)\\nin skb_try_coalesce() [1]\\n\\nI was able to root cause the issue to kfence.\\n\\nWhen kfence is in action, the following assertion is no longer true:\\n\\nint size = xxxx;\\nvoid *ptr1 = kmalloc(size, gfp);\\nvoid *ptr2 = kmalloc(size, gfp);\\n\\nif (ptr1 \u0026\u0026 ptr2)\\n\\tASSERT(ksize(ptr1) == ksize(ptr2));\\n\\nWe attempted to fix these issues in the blamed commits, but forgot\\nthat TCP was possibly shifting data after skb_unclone_keeptruesize()\\nhas been used, notably from tcp_retrans_try_collapse().\\n\\nSo we not only need to keep same skb-\u003etruesize value,\\nwe also need to make sure TCP wont fill new tailroom\\nthat pskb_expand_head() was able to get from a\\naddr = kmalloc(...) followed by ksize(addr)\\n\\nSplit skb_unclone_keeptruesize() into two parts:\\n\\n1) Inline skb_unclone_keeptruesize() for the common case,\\n   when skb is not cloned.\\n\\n2) Out of line __skb_unclone_keeptruesize() for the \u0027slow path\u0027.\\n\\nWARNING: CPU: 1 PID: 6490 at net/core/skbuff.c:5295 skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295\\nModules linked in:\\nCPU: 1 PID: 6490 Comm: syz-executor161 Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\nRIP: 0010:skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295\\nCode: bf 01 00 00 00 0f b7 c0 89 c6 89 44 24 20 e8 62 24 4e fa 8b 44 24 20 83 e8 01 0f 85 e5 f0 ff ff e9 87 f4 ff ff e8 cb 20 4e fa \u003c0f\u003e 0b e9 06 f9 ff ff e8 af b2 95 fa e9 69 f0 ff ff e8 95 b2 95 fa\\nRSP: 0018:ffffc900063af268 EFLAGS: 00010293\\nRAX: 0000000000000000 RBX: 00000000ffffffd5 RCX: 0000000000000000\\nRDX: ffff88806fc05700 RSI: ffffffff872abd55 RDI: 0000000000000003\\nRBP: ffff88806e675500 R08: 00000000ffffffd5 R09: 0000000000000000\\nR10: ffffffff872ab659 R11: 0000000000000000 R12: ffff88806dd554e8\\nR13: ffff88806dd9bac0 R14: ffff88806dd9a2c0 R15: 0000000000000155\\nFS:  00007f18014f9700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000020002000 CR3: 000000006be7a000 CR4: 00000000003506f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n tcp_try_coalesce net/ipv4/tcp_input.c:4651 [inline]\\n tcp_try_coalesce+0x393/0x920 net/ipv4/tcp_input.c:4630\\n tcp_queue_rcv+0x8a/0x6e0 net/ipv4/tcp_input.c:4914\\n tcp_data_queue+0x11fd/0x4bb0 net/ipv4/tcp_input.c:5025\\n tcp_rcv_established+0x81e/0x1ff0 net/ipv4/tcp_input.c:5947\\n tcp_v4_do_rcv+0x65e/0x980 net/ipv4/tcp_ipv4.c:1719\\n sk_backlog_rcv include/net/sock.h:1037 [inline]\\n __release_sock+0x134/0x3b0 net/core/sock.c:2779\\n release_sock+0x54/0x1b0 net/core/sock.c:3311\\n sk_wait_data+0x177/0x450 net/core/sock.c:2821\\n tcp_recvmsg_locked+0xe28/0x1fd0 net/ipv4/tcp.c:2457\\n tcp_recvmsg+0x137/0x610 net/ipv4/tcp.c:2572\\n inet_recvmsg+0x11b/0x5e0 net/ipv4/af_inet.c:850\\n sock_recvmsg_nosec net/socket.c:948 [inline]\\n sock_recvmsg net/socket.c:966 [inline]\\n sock_recvmsg net/socket.c:962 [inline]\\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: preserve skb_end_offset() en skb_unclone_keeptruesize() syzbot encontr\u00f3 otra forma de activar el infame WARN_ON_ONCE(delta \u0026lt; len) en skb_try_coalesce() [1] Pude atribuir el problema a kfence. Cuando kfence est\u00e1 en acci\u00f3n, la siguiente afirmaci\u00f3n ya no es verdadera: int size = xxxx; void *ptr1 = kmalloc(size, gfp); void *ptr2 = kmalloc(size, gfp); if (ptr1 \u0026amp;\u0026amp; ptr2) ASSERT(ksize(ptr1) == ksize(ptr2)); Intentamos solucionar estos problemas en las confirmaciones culpadas, pero olvidamos que TCP posiblemente estaba cambiando datos despu\u00e9s de que se haya utilizado skb_unclone_keeptruesize(), en particular desde tcp_retrans_try_collapse(). Por lo tanto, no solo debemos mantener el mismo valor de skb-\u0026gt;truesize, tambi\u00e9n debemos asegurarnos de que TCP no llene el nuevo espacio que pskb_expand_head() pudo obtener de un addr = kmalloc(...) seguido de ksize(addr). Dividir skb_unclone_keeptruesize() en dos partes: 1) skb_unclone_keeptruesize() en l\u00ednea para el caso com\u00fan, cuando skb no se clona. 2) __skb_unclone_keeptruesize() fuera de l\u00ednea para la \u0027ruta lenta\u0027. ADVERTENCIA: CPU: 1 PID: 6490 en net/core/skbuff.c:5295 skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295 M\u00f3dulos vinculados en: CPU: 1 PID: 6490 Comm: syz-executor161 No contaminado 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:skb_try_coalesce+0x1235/0x1560 net/core/skbuff.c:5295 C\u00f3digo: bf 01 00 00 00 0f b7 c0 89 c6 89 44 24 20 e8 62 24 4e fa 8b 44 24 20 83 e8 01 0f 85 e5 f0 ff ff e9 87 f4 ff ff e8 cb 20 4e fa \u0026lt;0f\u0026gt; 0b e9 06 f9 ff ff e8 af b2 95 fa e9 69 f0 ff ff e8 95 b2 95 fa RSP: 0018:ffffc900063af268 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 00000000ffffffd5 RCX: 0000000000000000 RDX: ffff88806fc05700 RSI: ffffffff872abd55 RDI: 0000000000000003 RBP: ffff88806e675500 R08: 00000000ffffffd5 R09: 0000000000000000 R10: ffffffff872ab659 R11: 0000000000000000 R12: ffff88806dd554e8 R13: ffff88806dd9bac0 R14: ffff88806dd9a2c0 R15: 0000000000000155 FS: 00007f18014f9700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020002000 CR3: 000000006be7a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000000 DR3: 00000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  tcp_try_coalesce net/ipv4/tcp_input.c:4651 [en l\u00ednea] tcp_try_coalesce+0x393/0x920 net/ipv4/tcp_input.c:4630 tcp_queue_rcv+0x8a/0x6e0 net/ipv4/tcp_input.c:4914 tcp_data_queue+0x11fd/0x4bb0 net/ipv4/tcp_input.c:5025 tcp_rcv_established+0x81e/0x1ff0 net/ipv4/tcp_input.c:5947 tcp_v4_do_rcv+0x65e/0x980 net/ipv4/tcp_ipv4.c:1719 sk_backlog_rcv include/net/sock.h:1037 [en l\u00ednea] __release_sock+0x134/0x3b0 net/core/sock.c:2779 release_sock+0x54/0x1b0 net/core/sock.c:3311 sk_wait_data+0x177/0x450 net/core/sock.c:2821 tcp_recvmsg_locked+0xe28/0x1fd0 net/ipv4/tcp.c:2457 tcp_recvmsg+0x137/0x610 net/ipv4/tcp.c:2572 inet_recvmsg+0x11b/0x5e0 net/ipv4/af_inet.c:850 sock_recvmsg_nosec net/socket.c:948 [en l\u00ednea] sock_recvmsg net/socket.c:966 [en l\u00ednea] sock_recvmsg net/socket.c:962 [en l\u00ednea] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [en l\u00ednea] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/skbuff.h\",\"net/core/skbuff.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"097b9146c0e26aabaa6ff3e5ea536a53f5254a79\",\"lessThan\":\"23629b673b780d967b88a850b1518cf0f0ffc6aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"097b9146c0e26aabaa6ff3e5ea536a53f5254a79\",\"lessThan\":\"a9a6d30264327d8ff7f23da33e7a77ffb793fa3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"097b9146c0e26aabaa6ff3e5ea536a53f5254a79\",\"lessThan\":\"a903e516f5df44b46d526b403d93e7be1a425538\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"097b9146c0e26aabaa6ff3e5ea536a53f5254a79\",\"lessThan\":\"2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7118945cdf0d4b5a76eb4f5f330ac6f48d372025\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec697f7f3f6a89d4dd1af113587d0330b5a033e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7582edf28f5d1f0a4d2f7abdb7d9560d09fd41b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5d55a6a46a7f70bc1d270c50200edd3096cb380c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e6af7cb64b7b37b8a371acdbe33a636496ffb5a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"97ff09a7ed484fef2b1bbc103857444b7332fca8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf5a58d143d7899d2c89e585be6e98ec81fe9683\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.4.260\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.260\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.224\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.179\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.103\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.21\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.4\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/skbuff.h\",\"net/core/skbuff.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4.260\",\"versionEndExcluding\":\"4.5\",\"matchCriteriaId\":\"184459E2-CD85-4614-95F3-2DCE9075D049\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.260\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"DC918819-19A0-4ACA-92EA-B8CA5FB74C47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.224\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"8944A7F6-3F7F-4FB3-B09D-13FF776763D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.179\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"09FD26FA-3243-4BFB-888A-FAD8B04EE388\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.103\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"77F47A48-724C-4A8A-BE16-F2C832EECA05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.21\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"FA8451E2-8B08-45A9-AEC4-3F6C9C651E35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.4\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"2B965B7B-E43F-4E19-9040-6F85F535AF61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23629b673b780d967b88a850b1518cf0f0ffc6aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2b88cba55883eaafbc9b7cbff0b2c7cdba71ed01\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a903e516f5df44b46d526b403d93e7be1a425538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9a6d30264327d8ff7f23da33e7a77ffb793fa3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:00:33+00:00",
      "cve": "CVE-2022-49142",
      "id": "CVE-2022-49142",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "166",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "124",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: preserve skb_end_offset() in skb_unclone_keeptruesize()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49142.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:30:11Z",
      "cve": "CVE-2022-49142",
      "id": "CVE-2022-49142",
      "initial_release_date": "2025-02-27T03:11:38Z",
      "product_status:known_affected": "61",
      "product_status:known_not_affected": "408",
      "product_status:recommended": "22",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49142",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49142.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.