CVE-2022-49672

In the Linux kernel, the following vulnerability has been resolved:

net: tun: unlink NAPI from device on destruction

Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we have to del them explicitly. The current code is missing deleting the NAPI if the queue was detached first.

This vulnerability is rated as Moderate severity because exploitation requires local access and winning a tight race condition, restricting the blast radius to a denial of service via a kernel crash. An attacker must possess local privileges sufficient to create, configure, or detach TUN/TAP network interfaces, typically requiring administrative capabilities or user namespace privileges. Environments that restrict unprivileged user namespaces and administrative network configuration are not exposed to unprivileged exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.