High · 7.5 CVE-2022-49048 EUVD-2022-55155GHSA-hv5h-q6gh-5q7w

ipv6: fix panic when forwarding a pkt with no in6 dev

Published Feb 26, 2025 · Updated Oct 15, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.4 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix panic when forwarding a pkt with no in6 dev

kongweibin reported a kernel panic in ip6_forward() when input interface
has no in6 dev associated.

The following tc commands were used to reproduce this panic:
tc qdisc del dev vxlan100 root
tc qdisc add dev vxlan100 root netem corrupt 5%

Affected products

Vendor	Product	Affected	Fixed
Linux	Linux	4.19.199 – < 4.19.239, 5.4.136 – < 5.4.190, 5.10.54 – < 5.10.112, 5.13.6 – < 5.14, 5.14	4.19.239

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	5.17.6-1	—
Debian 13	linux	5.17.6-1	—
Debian 12	linux	5.17.6-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	linux-raspi-realtime	No fix yet	—
Ubuntu 22.04 LTS	linux +1	5.15.0-37.39	—
Ubuntu 22.04 LTS	linux-aws	5.15.0-1011.14	—
Ubuntu 22.04 LTS	linux-azure	5.15.0-1010.12	—
Ubuntu 22.04 LTS	linux-gcp	5.15.0-1008.12	—
Ubuntu 22.04 LTS	linux-gke	5.15.0-1008.10	—
Ubuntu 22.04 LTS	linux-ibm	5.15.0-1007.8	—
Ubuntu 22.04 LTS	linux-intel-iotg	5.15.0-1008.11	—
Ubuntu 22.04 LTS	linux-kvm	5.15.0-1010.11	—
Ubuntu 22.04 LTS	linux-oracle	5.15.0-1009.12	—
Ubuntu 22.04 LTS	linux-raspi	5.15.0-1011.13	—
Ubuntu 22.04 LTS	linux-riscv +32	No fix yet	—
Ubuntu 20.04 LTS	linux	5.4.0-122.138	—
Ubuntu 20.04 LTS	linux-aws	5.4.0-1081.88	—
Ubuntu 20.04 LTS	linux-azure	5.4.0-1086.91	—
Ubuntu 20.04 LTS	linux-azure-5.15	5.15.0-1008.9~20.04.1	—
Ubuntu 20.04 LTS	linux-bluefield	5.4.0-1042.47	—
Ubuntu 20.04 LTS	linux-gcp	5.4.0-1084.92	—
Ubuntu 20.04 LTS	linux-gke +28	No fix yet	—
Ubuntu 20.04 LTS	linux-hwe-5.15	5.15.0-41.44~20.04.1	—
Ubuntu 20.04 LTS	linux-ibm	5.4.0-1029.33	—
Ubuntu 20.04 LTS	linux-intel-iotg-5.15	5.15.0-1008.11~20.04.1	—
Ubuntu 20.04 LTS	linux-iot	5.4.0-1004.6	—
Ubuntu 20.04 LTS	linux-kvm	5.4.0-1071.76	—
Ubuntu 20.04 LTS	linux-lowlatency-hwe-5.15	5.15.0-42.45~20.04.1	—
Ubuntu 20.04 LTS	linux-oracle	5.4.0-1079.87	—
Ubuntu 20.04 LTS	linux-raspi	5.4.0-1066.76	—
Ubuntu 18.04 LTS	linux-aws-5.4	5.4.0-1081.88~18.04.1	—
Ubuntu 18.04 LTS	linux-azure-5.4	5.4.0-1086.91~18.04.1	—
Ubuntu 18.04 LTS	linux-gcp +14	No fix yet	—
Ubuntu 18.04 LTS	linux-gcp-5.4	5.4.0-1084.92~18.04.1	—
Ubuntu 18.04 LTS	linux-hwe-5.4	5.4.0-122.138~18.04.1	—
Ubuntu 18.04 LTS	linux-ibm-5.4	5.4.0-1029.33~18.04.1	—
Ubuntu 18.04 LTS	linux-oracle-5.4	5.4.0-1079.87~18.04.1	—
Ubuntu 18.04 LTS	linux-raspi-5.4	5.4.0-1066.76~18.04.1	—
Ubuntu 16.04 LTS	linux-hwe-edge	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro Realtime 22.04 LTS	linux-realtime	5.15.0-1014.14	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-aws-fips +1	5.4.0-1081.88+fips1	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-azure-fips	5.4.0-1086.91+fips1	—
Ubuntu Pro FIPS-updates 20.04 LTS	linux-fips	5.4.0-1057.65	—

References