CVE-2022-49858

Linux kernel: information disclosure

Risk score: 50/100
CVSS: 5.5 v3.1
Exploit chance (30 days): 0.2%
Published: 1 May 2025

Open in the live forecast Today's forecast

What to know

What it is: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same index is processed in N…
Affected: Linux kernel
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …

The flaws

CVE-2022-49858: Information disclosure (CVSS 5.5 · EPSS 0%)
CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

No known exploitation

How it unfolded

3 Nov, Ubuntu security notices (official): USN-8962-1: Linux kernel (Azure CVM) vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8961-1: Linux kernel vulnerabilities

Connects to

Same weakness: Out-of-bounds write (CWE-787). 365 other warnings in 30 days
Same product: Earlier Linux kernel warnings. 105 in the last 90 days

Why it is Yellow

CVSS 5.5 medium
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same index is processed in NAPI resulting losing SKB pointers, hence a leak. Fix this by checking a consumer index which is updated once CQE is processed.

Last activity 3 Nov 2026. Patch Forecast updates every hour.