CVE-2022-49636 – A memory leak vulnerability in the Linux kernel... (How to Fix)

Q: What is the severity of CVE-2022-49636?

CVE-2022-49636 has a CVSS score of 5.5 (MEDIUM). A memory leak vulnerability in the Linux kernel's VLAN implementation allows attackers to cause denial of service by exhausting kernel memory. The vulnerability occurs when creating VLAN interfaces with specific egress QoS mappings, affecting systems using VLAN functionality. This affects Linux systems with vulnerable kernel versions.

📋 TL;DR

A memory leak vulnerability in the Linux kernel's VLAN implementation allows attackers to cause denial of service by exhausting kernel memory. The vulnerability occurs when creating VLAN interfaces with specific egress QoS mappings, affecting systems using VLAN functionality. This affects Linux systems with vulnerable kernel versions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions between commits introducing and fixing the bug (check stable kernel versions)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when VLAN functionality is used with egress QoS mappings

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory exhaustion leading to system instability, crashes, or denial of service requiring reboot

🟠

Likely Case

Gradual memory consumption over time when VLAN interfaces are created with specific QoS mappings, potentially causing performance degradation

🟢

If Mitigated

Minimal impact if VLAN functionality is not used or systems are patched

🌐 Internet-Facing: LOW - Requires local access or ability to create VLAN interfaces

🏢 Internal Only: MEDIUM - Could be exploited by users with network configuration privileges

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires ability to create VLAN interfaces (typically root or CAP_NET_ADMIN)

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel versions with fixes from stable commits listed in references

Vendor Advisory: https://git.kernel.org/stable/c/4c43069bb1097dd6cc1cf0f7c43a36d1f7b3910b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable VLAN QoS functionality

linux

Prevent creation of VLAN interfaces with egress QoS mappings

# Restrict VLAN interface creation or QoS usage via system policies

🧯 If You Can't Patch

Restrict VLAN interface creation to trusted users only
Monitor kernel memory usage and system logs for memory leak indicators

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if VLAN QoS functionality is enabled

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to patched version and test VLAN QoS creation

📡 Detection & Monitoring

Log Indicators:

Kernel OOM messages
Memory allocation failures in kernel logs

Network Indicators:

Multiple VLAN interface creation attempts with QoS mappings

SIEM Query:

Search for 'vlan_newlink' or 'memory leak' in kernel logs

📊 Metadata

CVE ID: CVE-2022-49636

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.05% exploit probability (16.3th percentile)

Published: February 26, 2025

Last Updated: April 10, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49636, you might also want to check these: