CVE-2022-49048

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix panic when forwarding a pkt with no in6 dev

kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated.

The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5%

This vulnerability has been rated as having a Moderate impact because triggering the denial of service requires forwarding IPv6 packets across an interface lacking an associated IPv6 device configuration, which typically demands local administrative privileges or an atypical network topology. Under standard Red Hat Enterprise Linux deployments, IPv6 packet forwarding is disabled by default, significantly limiting the exposure of typical host systems. While an unhandled condition can crash the operating system, the flaw cannot be leveraged for privilege escalation or unauthorized disclosure or modification of data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.