CVE-2022-49642 – A Linux kernel vulnerability in the Synopsys DW... (How to Fix)

Q: What is the severity of CVE-2022-49642?

CVE-2022-49642 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in the Synopsys DWC Ethernet driver for Tegra194 systems causes integer overflow when split header feature is enabled. This leads to kernel crashes when processing malformed network packets. Only systems with Tegra194 hardware running affected Linux kernel versions are impacted.

📋 TL;DR

A Linux kernel vulnerability in the Synopsys DWC Ethernet driver for Tegra194 systems causes integer overflow when split header feature is enabled. This leads to kernel crashes when processing malformed network packets. Only systems with Tegra194 hardware running affected Linux kernel versions are impacted.

💻 Affected Systems

Products:

Linux kernel with stmmac driver for Tegra194

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with NVIDIA Tegra194 hardware where split header feature is enabled in the stmmac driver.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

Random system crashes when processing certain network traffic, resulting in downtime and service interruptions.

🟢

If Mitigated

No impact if split header feature is disabled or system is patched.

🌐 Internet-Facing: MEDIUM - Remote attackers could trigger crashes by sending specially crafted packets to vulnerable systems.

🏢 Internal Only: MEDIUM - Internal network traffic could also trigger the vulnerability, causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending network packets to trigger the integer overflow. No authentication needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 029c1c2059e9c4b38f97a06204cdecd10cfbeb8a or later

Vendor Advisory: https://git.kernel.org/stable/c/029c1c2059e9c4b38f97a06204cdecd10cfbeb8a

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable split header feature

linux

Manually disable the split header feature in the stmmac driver for Tegra194 systems

echo 0 > /sys/class/net/<interface>/split_hdr

🧯 If You Can't Patch

Implement network filtering to block suspicious packets to affected systems
Isolate Tegra194 systems from untrusted networks

🔍 How to Verify

Check if Vulnerable:

Check if system has Tegra194 hardware and if split header is enabled: cat /sys/class/net/<interface>/split_hdr

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commit or verify split header is disabled for Tegra194

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
System crash dumps
Network driver error messages

Network Indicators:

Unexpected large packets to Tegra194 systems

SIEM Query:

source="kernel" AND ("panic" OR "crash" OR "stmmac" OR "dwc-qos")

📊 Metadata

CVE ID: CVE-2022-49642

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-190

EPSS Score: 0.07% exploit probability (20.3th percentile)

Published: February 26, 2025

Last Updated: October 23, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49642, you might also want to check these: