GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49275 (GCVE-0-2022-49275)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-08-05 08:54
VLAI
Title
can: m_can: m_can_tx_handler(): fix use after free of skb
Summary
In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_tx_handler(): fix use after free of skb can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-04 18:03 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < d93ed9aff64968f4cdad690712eb4f48ae537bde (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < d3892a747ab16b1eb6593a19d29f62c3b3f020ac (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < 7728d937ec403a1ceff9483023252d2cb8777f81 (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < 08d90846e438ac22dc56fc49ec0b0d195831c5ed (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < 869016a2938ac44f7b2fb7fc22c89edad99eb9b3 (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < f43e64076ff1b1dcb893fb77ad1204105f710a29 (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < 4db7d6f481990dd179a9ee7126dc7aa31ea4fff3 (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < 31417073493f302d26ab66b3abc098d43227b835 (git)
Affected: 80646733f11c2e9de3b6339f7e635047e6087280 , < 2e8e79c416aae1de224c0f1860f2e3350fa171f8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 4.9.324 , ≤ 4.9.* (semver)
Unaffected: 4.14.289 , ≤ 4.14.* (semver)
Unaffected: 4.19.253 , ≤ 4.19.* (semver)
Unaffected: 5.4.207 , ≤ 5.4.* (semver)
Unaffected: 5.10.110 , ≤ 5.10.* (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49275",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T18:03:19.289491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-04T18:07:17.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/m_can/m_can.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d93ed9aff64968f4cdad690712eb4f48ae537bde",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "d3892a747ab16b1eb6593a19d29f62c3b3f020ac",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "7728d937ec403a1ceff9483023252d2cb8777f81",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "08d90846e438ac22dc56fc49ec0b0d195831c5ed",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "869016a2938ac44f7b2fb7fc22c89edad99eb9b3",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "f43e64076ff1b1dcb893fb77ad1204105f710a29",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "4db7d6f481990dd179a9ee7126dc7aa31ea4fff3",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "31417073493f302d26ab66b3abc098d43227b835",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            },
            {
              "lessThan": "2e8e79c416aae1de224c0f1860f2e3350fa171f8",
              "status": "affected",
              "version": "80646733f11c2e9de3b6339f7e635047e6087280",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/m_can/m_can.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.324",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.289",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.207",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.324",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.289",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.253",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.207",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: m_can: m_can_tx_handler(): fix use after free of skb\n\ncan_put_echo_skb() will clone skb then free the skb. Move the\ncan_put_echo_skb() for the m_can version 3.0.x directly before the\nstart of the xmit in hardware, similar to the 3.1.x branch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in m_can_tx_handler on the ndo_start_xmit/TX work path, reached when a local process sends via AF_CAN (raw_sendmsg \u2192 can_send \u2192 m_can_start_xmit), not when processing frames received from the CAN bus. Same TX-local scoring as other SocketCAN transmit bugs rather than adjacent bus RX.\nAC:L - On M_CAN IP v3.0.x with CAN_CTRLMODE_FD enabled, every transmit deterministically calls can_put_echo_skb() (which frees the skb) and then can_is_canfd_skb(skb)/cf-\u003eflags on the freed pointer; the attacker fully controls when frames are sent and no race is required.\nPR:L - socket(PF_CAN)/bind/sendmsg impose no capability checks, so an unprivileged local user can trigger the path on an already-up m_can interface typical of automotive/industrial deployments; CAP_NET_ADMIN is only needed for bring-up/bitrate, not for TX.\nUI:N - The attacker triggers the UAF solely by sending crafted/ordinary CAN frames on the interface; no separate victim action such as mounting a device or opening a file is required.\nS:U - Impact is use-after-free of a kernel sk_buff within the host SocketCAN/m_can driver under the same OS authority, enabling standard local privilege escalation rather than a VM/IOMMU/sandbox escape.\nC:H - can_put_echo_skb()/can_create_echo_skb() frees the original sk_buff while the TX path still reads skb-\u003elen and skb-\u003edata; reclaiming that slab object yields a classic UAF read/disclosure primitive scored Confidentiality High.\nI:H - The same sk_buff UAF is heap memory corruption that enables spraying and write/control-flow primitives typical of exploitable kernel use-after-frees, so Integrity is High per UAF guidance even though the immediate post-free accesses are reads.\nA:H - Dereferencing the freed sk_buff in the TX path can oops/panic the kernel (and UAF bugs are scored Availability High even when not fully exploited), fully denying host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:32.809Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d93ed9aff64968f4cdad690712eb4f48ae537bde"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3892a747ab16b1eb6593a19d29f62c3b3f020ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/7728d937ec403a1ceff9483023252d2cb8777f81"
        },
        {
          "url": "https://git.kernel.org/stable/c/08d90846e438ac22dc56fc49ec0b0d195831c5ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/869016a2938ac44f7b2fb7fc22c89edad99eb9b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f43e64076ff1b1dcb893fb77ad1204105f710a29"
        },
        {
          "url": "https://git.kernel.org/stable/c/4db7d6f481990dd179a9ee7126dc7aa31ea4fff3"
        },
        {
          "url": "https://git.kernel.org/stable/c/31417073493f302d26ab66b3abc098d43227b835"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e8e79c416aae1de224c0f1860f2e3350fa171f8"
        }
      ],
      "title": "can: m_can: m_can_tx_handler(): fix use after free of skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49275",
    "datePublished": "2025-02-26T01:56:20.066Z",
    "dateReserved": "2025-02-26T01:49:39.298Z",
    "dateUpdated": "2026-08-05T08:54:32.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49275",
      "date": "2026-09-18",
      "epss": "0.00276",
      "percentile": "0.20215"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/m_can/m_can.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d93ed9aff64968f4cdad690712eb4f48ae537bde",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3892a747ab16b1eb6593a19d29f62c3b3f020ac",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7728d937ec403a1ceff9483023252d2cb8777f81",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08d90846e438ac22dc56fc49ec0b0d195831c5ed",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "869016a2938ac44f7b2fb7fc22c89edad99eb9b3",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f43e64076ff1b1dcb893fb77ad1204105f710a29",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4db7d6f481990dd179a9ee7126dc7aa31ea4fff3",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "31417073493f302d26ab66b3abc098d43227b835",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2e8e79c416aae1de224c0f1860f2e3350fa171f8",
                    "status": "affected",
                    "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/can/m_can/m_can.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.18"
                  },
                  {
                    "lessThan": "3.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.324",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.289",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.253",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.207",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.16.*",
                    "status": "unaffected",
                    "version": "5.16.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "86D6E5BE-2946-4C39-8AB8-0AE8ED114B4D",
                    "versionEndExcluding": "4.9.324",
                    "versionStartIncluding": "3.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9209AEEF-782D-43E6-AA5C-9F5B9CD6ED11",
                    "versionEndExcluding": "4.14.289",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2B22ACD7-9025-4AD5-AD6E-A929DEC79B75",
                    "versionEndExcluding": "4.19.253",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C27A52F3-82C8-4F03-BE80-38D11CDBD503",
                    "versionEndExcluding": "5.4.207",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "91D3BFD0-D3F3-4018-957C-96CCBF357D79",
                    "versionEndExcluding": "5.10.110",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27C42AE8-B387-43E2-938A-E1C8B40BE6D5",
                    "versionEndExcluding": "5.15.33",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20C43679-0439-405A-B97F-685BEE50613B",
                    "versionEndExcluding": "5.16.19",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF",
                    "versionEndExcluding": "5.17.2",
                    "versionStartIncluding": "5.17",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: m_can: m_can_tx_handler(): fix use after free of skb\n\ncan_put_echo_skb() will clone skb then free the skb. Move the\ncan_put_echo_skb() for the m_can version 3.0.x directly before the\nstart of the xmit in hardware, similar to the 3.1.x branch."
          },
          {
            "lang": "es",
            "value": "En el n\u00facleo de Linux, se ha resuelto la siguiente vulnerabilidad: can: m_can: m_can_tx_handler(): se corrige el use after free skb can_put_echo_skb() clonar\u00e1 skb y luego lo liberar\u00e1. Mueva can_put_echo_skb() para la versi\u00f3n 3.0.x de m_can directamente antes del inicio de la transmisi\u00f3n en el hardware, de manera similar a la rama 3.1.x."
          }
        ],
        "id": "CVE-2022-49275",
        "lastModified": "2026-06-17T05:17:34.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49275",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-04T18:03:19.289491Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:04.370",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/08d90846e438ac22dc56fc49ec0b0d195831c5ed"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2e8e79c416aae1de224c0f1860f2e3350fa171f8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/31417073493f302d26ab66b3abc098d43227b835"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4db7d6f481990dd179a9ee7126dc7aa31ea4fff3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7728d937ec403a1ceff9483023252d2cb8777f81"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/869016a2938ac44f7b2fb7fc22c89edad99eb9b3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3892a747ab16b1eb6593a19d29f62c3b3f020ac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d93ed9aff64968f4cdad690712eb4f48ae537bde"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f43e64076ff1b1dcb893fb77ad1204105f710a29"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:02:50+00:00",
      "cve": "CVE-2022-49275",
      "id": "CVE-2022-49275",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: m_can: m_can_tx_handler(): fix use after free of skb",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49275.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T17:11:20Z",
      "cve": "CVE-2022-49275",
      "id": "CVE-2022-49275",
      "initial_release_date": "2025-02-27T03:09:35Z",
      "product_status:known_affected": "495",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "372",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49275",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49275.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49275",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-04T18:03:19.289491Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-04T18:03:20.559Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/can/m_can/m_can.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "d93ed9aff64968f4cdad690712eb4f48ae537bde",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "d3892a747ab16b1eb6593a19d29f62c3b3f020ac",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "7728d937ec403a1ceff9483023252d2cb8777f81",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "08d90846e438ac22dc56fc49ec0b0d195831c5ed",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "869016a2938ac44f7b2fb7fc22c89edad99eb9b3",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "f43e64076ff1b1dcb893fb77ad1204105f710a29",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "4db7d6f481990dd179a9ee7126dc7aa31ea4fff3",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "31417073493f302d26ab66b3abc098d43227b835",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                },
                {
                  "lessThan": "2e8e79c416aae1de224c0f1860f2e3350fa171f8",
                  "status": "affected",
                  "version": "80646733f11c2e9de3b6339f7e635047e6087280",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/can/m_can/m_can.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.18"
                },
                {
                  "lessThan": "3.18",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.324",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.289",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.253",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.207",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.110",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.33",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.16.*",
                  "status": "unaffected",
                  "version": "5.16.19",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.18",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.324",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.289",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.253",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.207",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.110",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.33",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.16.19",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.2",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18",
                      "versionStartIncluding": "3.18",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: m_can: m_can_tx_handler(): fix use after free of skb\n\ncan_put_echo_skb() will clone skb then free the skb. Move the\ncan_put_echo_skb() for the m_can version 3.0.x directly before the\nstart of the xmit in hardware, similar to the 3.1.x branch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The UAF is in m_can_tx_handler on the ndo_start_xmit/TX work path, reached when a local process sends via AF_CAN (raw_sendmsg \u2192 can_send \u2192 m_can_start_xmit), not when processing frames received from the CAN bus. Same TX-local scoring as other SocketCAN transmit bugs rather than adjacent bus RX.\nAC:L - On M_CAN IP v3.0.x with CAN_CTRLMODE_FD enabled, every transmit deterministically calls can_put_echo_skb() (which frees the skb) and then can_is_canfd_skb(skb)/cf-\u003eflags on the freed pointer; the attacker fully controls when frames are sent and no race is required.\nPR:L - socket(PF_CAN)/bind/sendmsg impose no capability checks, so an unprivileged local user can trigger the path on an already-up m_can interface typical of automotive/industrial deployments; CAP_NET_ADMIN is only needed for bring-up/bitrate, not for TX.\nUI:N - The attacker triggers the UAF solely by sending crafted/ordinary CAN frames on the interface; no separate victim action such as mounting a device or opening a file is required.\nS:U - Impact is use-after-free of a kernel sk_buff within the host SocketCAN/m_can driver under the same OS authority, enabling standard local privilege escalation rather than a VM/IOMMU/sandbox escape.\nC:H - can_put_echo_skb()/can_create_echo_skb() frees the original sk_buff while the TX path still reads skb-\u003elen and skb-\u003edata; reclaiming that slab object yields a classic UAF read/disclosure primitive scored Confidentiality High.\nI:H - The same sk_buff UAF is heap memory corruption that enables spraying and write/control-flow primitives typical of exploitable kernel use-after-frees, so Integrity is High per UAF guidance even though the immediate post-free accesses are reads.\nA:H - Dereferencing the freed sk_buff in the TX path can oops/panic the kernel (and UAF bugs are scored Availability High even when not fully exploited), fully denying host availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:54:32.809Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/d93ed9aff64968f4cdad690712eb4f48ae537bde"
            },
            {
              "url": "https://git.kernel.org/stable/c/d3892a747ab16b1eb6593a19d29f62c3b3f020ac"
            },
            {
              "url": "https://git.kernel.org/stable/c/7728d937ec403a1ceff9483023252d2cb8777f81"
            },
            {
              "url": "https://git.kernel.org/stable/c/08d90846e438ac22dc56fc49ec0b0d195831c5ed"
            },
            {
              "url": "https://git.kernel.org/stable/c/869016a2938ac44f7b2fb7fc22c89edad99eb9b3"
            },
            {
              "url": "https://git.kernel.org/stable/c/f43e64076ff1b1dcb893fb77ad1204105f710a29"
            },
            {
              "url": "https://git.kernel.org/stable/c/4db7d6f481990dd179a9ee7126dc7aa31ea4fff3"
            },
            {
              "url": "https://git.kernel.org/stable/c/31417073493f302d26ab66b3abc098d43227b835"
            },
            {
              "url": "https://git.kernel.org/stable/c/2e8e79c416aae1de224c0f1860f2e3350fa171f8"
            }
          ],
          "title": "can: m_can: m_can_tx_handler(): fix use after free of skb",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49275",
        "datePublished": "2025-02-26T01:56:20.066Z",
        "dateReserved": "2025-02-26T01:49:39.298Z",
        "dateUpdated": "2026-08-05T08:54:32.809Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.