CVE-2022-49093
A critical bug in the Linux kernel’s networking stack caused a use‑after‑free when certain packets were coalesced, potentially corrupting memory or crashing the system. The flaw was fixed in a kernel update. Users should update to a kernel that includes the patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including version 5.18 and later releases that have not yet applied the patch.
Real-world impact
An attacker could trigger the bug by sending crafted network traffic, leading to memory corruption, kernel crashes, or privilege escalation on the affected system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable remotely without authentication, with full confidentiality, integrity, and availability impact, and requires no user interaction.
What to do about it
- 011. Update the Linux kernel to a version that includes the fix for CVE-2022-49093.
- 022. Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Feb 26, 2025 · Feb 26, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.