CVE-2022-50816— ipv6: ensure sane device mtu in tunnels
Possible ATT&CK Techniques 1AI
T1055 · Process InjectionAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | c12b395a46646bab69089ce7016ac78177f6001f< 2bab6fa449d16af36d9c9518865f783a15f446c7 | affected |
c12b395a46646bab69089ce7016ac78177f6001f< 78297d513157a31fd629626fe4cbb85a7dcbb94a | affected | ||
c12b395a46646bab69089ce7016ac78177f6001f< af51fc23a03f02b0c6df09ab0d60f23794436052 | affected | ||
c12b395a46646bab69089ce7016ac78177f6001f< 44affe7ede596f078c4f2f41e0d160266ccda818 | affected | ||
c12b395a46646bab69089ce7016ac78177f6001f< ad3f1d9bf162c487d23df684852597961b745cae | affected | ||
c12b395a46646bab69089ce7016ac78177f6001f< ccd94bd4939690e24d13e23814bce7ed853a09f3 | affected | ||
c12b395a46646bab69089ce7016ac78177f6001f< d89d7ff01235f218dad37de84457717f699dee79 | affected | ||
3.7 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-50816
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ipv6: ensure sane device mtu in tunnels
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: ensure sane device mtu in tunnels Another syzbot report [1] with no reproducer hints at a bug in ip6_gre tunnel (dev:ip6gretap0) Since ipv6 mcast code makes sure to read dev->mtu once and applies a sanity check on it (see commit b9b312a7a451 "ipv6: mcast: better catch silly mtu values"), a remaining possibility is that a layer is able to set dev->mtu to an underflowed value (high order bit set). This could happen indeed in ip6gre_tnl_link_config_route(), ip6_tnl_link_config() and ipip6_tunnel_bind_dev() Make sure to sanitize mtu value in a local variable before it is written once on dev->mtu, as lockless readers could catch wrong temporary value. [1] skbuff: skb_over_panic: text:ffff80000b7a2f38 len:40 put:40 head:ffff000149dcf200 data:ffff000149dcf2b0 tail:0xd8 end:0xc0 dev:ip6gretap0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:120 Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 10241 Comm: kworker/1:1 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 Workqueue: mld mld_ifc_work pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic+0x4c/0x50 net/core/skbuff.c:116 lr : skb_panic+0x4c/0x50 net/core/skbuff.c:116 sp : ffff800020dd3b60 x29: ffff800020dd3b70 x28: 0000000000000000 x27: ffff00010df2a800 x26: 00000000000000c0 x25: 00000000000000b0 x24: ffff000149dcf200 x23: 00000000000000c0 x22: 00000000000000d8 x21: ffff80000b7a2f38 x20: ffff00014c2f7800 x19: 0000000000000028 x18: 00000000000001a9 x17: 0000000000000000 x16: ffff80000db49158 x15: ffff000113bf1a80 x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000113bf1a80 x11: ff808000081c0d5c x10: 0000000000000000 x9 : 73f125dc5c63ba00 x8 : 73f125dc5c63ba00 x7 : ffff800008161d1c x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic+0x4c/0x50 net/core/skbuff.c:116 skb_over_panic net/core/skbuff.c:125 [inline] skb_put+0xd4/0xdc net/core/skbuff.c:2049 ip6_mc_hdr net/ipv6/mcast.c:1714 [inline] mld_newpack+0x14c/0x270 net/ipv6/mcast.c:1765 add_grhead net/ipv6/mcast.c:1851 [inline] add_grec+0xa20/0xae0 net/ipv6/mcast.c:1989 mld_send_cr+0x438/0x5a8 net/ipv6/mcast.c:2115 mld_ifc_work+0x38/0x290 net/ipv6/mcast.c:2653 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 worker_thread+0x340/0x610 kernel/workqueue.c:2436 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: 91011400 aa0803e1 a90027ea 94373093 (d4210000)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于隧道设备MTU值未进行完整性检查，可能导致下溢值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50816
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50816
请登录查看更多情报信息。
Other References for CVE-2022-50816 (7)
Same Patch Batch · Linux · 2025-12-30 · 244 CVEs total
| CVE-2023-54184 | 9.8 CRITICAL | scsi: target: iscsit: Free cmds before session free |
| CVE-2023-54223 | 9.8 CRITICAL | net/mlx5e: xsk: Fix invalid buffer access for legacy rq |
| CVE-2023-54237 | 9.8 CRITICAL | net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() |
| CVE-2023-54292 | 9.8 CRITICAL | RDMA/irdma: Fix data race on CQP request done |
| CVE-2023-54280 | 9.8 CRITICAL | cifs: fix potential race when tree connecting ipc |
| CVE-2023-54269 | 9.8 CRITICAL | SUNRPC: double free xprt_ctxt while still in use |
| CVE-2023-54258 | 9.8 CRITICAL | cifs: fix potential oops in cifs_oplock_break |
| CVE-2023-54257 | 9.8 CRITICAL | net: macb: fix a memory corruption in extended buffer descriptor mode |
| CVE-2023-54203 | 9.1 CRITICAL | ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr |
| CVE-2023-54318 | 8.8 HIGH | net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add |
| CVE-2023-54162 | 8.8 HIGH | ksmbd: fix possible memory leak in smb2_lock() |
| CVE-2023-54214 | 8.8 HIGH | Bluetooth: L2CAP: Fix potential user-after-free |
| CVE-2022-50880 | 8.8 HIGH | wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() |
| CVE-2023-54262 | 8.8 HIGH | net/mlx5e: Don't clone flow post action attributes second time |
| CVE-2023-54250 | 8.2 HIGH | ksmbd: avoid out of bounds access in decode_preauth_ctxt() |
| CVE-2023-54164 | 8.0 HIGH | Bluetooth: ISO: fix iso_conn related locking and validity issues |
| CVE-2023-54202 | 7.8 HIGH | drm/i915: fix race condition UAF in i915_perf_add_config_ioctl |
| CVE-2023-54317 | 7.8 HIGH | dm flakey: don't corrupt the zero page |
| CVE-2022-50841 | 7.8 HIGH | fs/ntfs3: Add overflow check for attribute size |
| CVE-2023-54201 | 7.8 HIGH | RDMA/efa: Fix wrong resources deallocation order |
Showing top 20 of 244 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-68454
KVM: s390: pci: Fix handling of AIF enable without AISB - CVE-2026-68453
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey - CVE-2026-68452
s390/zcrypt: Validate length for CCA AES cipher key requests - CVE-2026-68451
s390/zcrypt: Validate length for CCA ECC private key request - CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert
Same vendor: Linux
- CVE-2026-68454
KVM: s390: pci: Fix handling of AIF enable without AISB - CVE-2026-68453
s390/zcrypt: Fix buffer over-read in cca_cipher2protkey - CVE-2026-68452
s390/zcrypt: Validate length for CCA AES cipher key requests - CVE-2026-68451
s390/zcrypt: Validate length for CCA ECC private key request - CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert
V. Comments for CVE-2022-50816
No comments yet