CVE-2022-49094
A slab-out-of-bounds bug exists in the Linux kernel's TLS decryption routine for AES128-CCM, where a memcpy reads 16 bytes from a 12‑byte buffer. This can lead to information disclosure, privilege escalation, or denial of service. The vulnerability has been resolved in the Linux kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, particularly those using versions that include the vulnerable net/tls code (e.g., 5.18).
Real-world impact
An attacker could trigger out-of-bounds reads via TLS traffic, potentially leaking kernel memory or causing a crash.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Obtain the latest Linux kernel update from your distribution that includes the fix for the net/tls slab‑out‑of‑bounds bug (the vulnerability is marked as resolved in the kernel).
- 022. Install or upgrade the kernel package.
- 033. Reboot the system to load the patched kernel.
NVD description states the vulnerability has been resolved in the Linux kernel.
Timeline
- Feb 26, 2025 · Feb 26, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.