7.8

CVE-2022-48742: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()

Modified
AliasesUBUNTU-CVE-2022-48742DEBIAN-CVE-2022-48742
Published 20-06-2024Last modified 05-08-2026

Vulnerability summary

CVE-2022-48742 is a high (CVSS 7.8) Use After Free vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
SUSE-SU-2025:0201-1SUSE-SU-2025:0201-2SUSE-SU-2025:0229-1SUSE-SU-2025:0236-1

Timeline

  1. 20-06-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potentially trigger use-after-free. It is better to clear master_dev and m_ops inside the loop, in case we have to replay it.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.24% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu90 products
  • linuxAll versions (No fix recorded) | < 4.15.0-176.185 | < 5.4.0-109.123
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1127.136 | < 5.4.0-1072.77
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < 2cf180360d66bd657e606c1217e0e668e6faa303 | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < 7d9211678c0f0624f74cdff36117ab8316697bb8 | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < a01e60a1ec6bef9be471fb7182a33c6d6f124e93 | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < bd43771ee9759dd9dfae946bff190e2c5a120de5 | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < 3bbe2019dd12b8d13671ee6cda055d49637b4c39 | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < def5e7070079b2a214b3b1a2fbec623e6fbfe34a | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < 36a9a0aee881940476b254e0352581401b23f210 | ≥ ba7d49b1f0f8e5f24294a880ed576964059af5ef, < c6f6f2444bdbe0079e41914a35081530d0409963 | 3.14
  • linux_kernel≥ 3.14, < 4.9.300 | ≥ 4.10, < 4.14.265 | ≥ 4.15, < 4.19.228 | ≥ 4.20, < 5.4.177 | ≥ 5.5, < 5.10.97 | ≥ 5.11, < 5.15.20 | ≥ 5.16, < 5.16.6
Debian1 product
  • linux< 5.16.7-1

3 vendors · 93 products

References

12 links
Show all 12 references