CVE-2022-49664
tipc: move bc link creation back to tipc_node_create
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] [] Call Trace: [] <IRQ> [] tipc_bcast_rcv+0xa2/0x190 [tipc] [] tipc_node_bc_rcv+0x8b/0x200 [tipc] [] tipc_rcv+0x3af/0x5b0 [tipc] [] tipc_udp_recv+0xc7/0x1e0 [tipc] It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it creates a node in tipc_node_check_dest(), after inserting the new node into hashtable in tipc_node_create(), it creates the bc link. However, there is a gap between this insert and bc link creation, a bc packet may come in and get the node from the hashtable then try to dereference its bc link, which is NULL. This patch is to fix it by moving the bc link creation before inserting into the hashtable. Note that for a preliminary node becoming "real", the bc link creation should also be called before it's rehashed, as we don't create it for preliminary nodes.
Timeline
ID reserved
By Linux
Published
- 18 months later
· 18 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CISA-ADPADP (enrichment) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.69% · top 47% of all CVEs (8 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 – < 456bc338871c4a52117dd5ef29cce3745456d248
- affected 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 – < 35fcb2ba35b4d9b592b558c3bcc6e0d90e213588
- affected 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 – < e52910e671f58c619e33dac476b11b35e2d3ab6f
- affected 4cbf8ac2fe5a0846508fe02b95a5de1a90fa73f4 – < cb8092d70a6f5f01ec1490fce4d35efed3ed996c
- affected 0b8f0026bbd4df1688e1726026476e60762daf2a
- affected 5.4.287 – < 5.5
- affected 5.5
- unaffected < 5.5
- unaffected 5.10.129 – ≤ 5.10.*
- unaffected 5.15.53 – ≤ 5.15.*
- unaffected 5.18.10 – ≤ 5.18.*
- unaffected 5.19 – ≤ *
References (4)
- https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248 (opens in a new tab)
- https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588 (opens in a new tab)
- https://git.kernel.org/stable/c/e52910e671f58c619e33dac476b11b35e2d3ab6f (opens in a new tab)
- https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-49664)Record last updated .