CVE-2022-49865 – This CVE describes an information leak vulnerab... (How to Fix)

Q: What is the severity of CVE-2022-49865?

CVE-2022-49865 has a CVSS score of 7.1 (HIGH). This CVE describes an information leak vulnerability in the Linux kernel's IPv6 address label implementation. When sending network messages containing struct ifaddrlmsg, an uninitialized memory byte (__ifal_reserved field) could be exposed to the network, potentially leaking sensitive kernel memory contents. This affects Linux systems with IPv6 enabled.

📋 TL;DR

This CVE describes an information leak vulnerability in the Linux kernel's IPv6 address label implementation. When sending network messages containing struct ifaddrlmsg, an uninitialized memory byte (__ifal_reserved field) could be exposed to the network, potentially leaking sensitive kernel memory contents. This affects Linux systems with IPv6 enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 functionality and the ability to trigger the ip6addrlbl_get function via netlink.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

An attacker could exploit this to leak kernel memory contents, potentially revealing sensitive information like encryption keys, process memory, or other system data that could facilitate further attacks.

🟠

Likely Case

Limited information disclosure of 1 byte of uninitialized kernel memory per affected network message, which could be used to infer kernel state or aid in other attacks.

🟢

If Mitigated

With proper network segmentation and access controls, the impact is minimal as the leak requires network access to the affected interface.

🌐 Internet-Facing: MEDIUM - Requires IPv6 connectivity and ability to trigger the affected code path, but information leaks can be valuable for attackers.

🏢 Internal Only: MEDIUM - Internal attackers with network access could exploit this to gather information about kernel state.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access or network access to trigger the vulnerable code path via netlink messages.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bf, 2acb2779b147decd300c117683d5a32ce61c75d6, 49e92ba5ecd7d72ba369dde2ccff738edd028a47, 568a47ff756f913e8b374c2af9d22cd2c772c744, or 58cd7fdc8c1e6c7873acc08f190069fed88d1c12

Vendor Advisory: https://git.kernel.org/stable/c/0f85b7ae7c4b5d7b4bbf7ac653a733c181a8a2bf

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable IPv6

linux

Disable IPv6 functionality to prevent exploitation of this vulnerability

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
sysctl -w net.ipv6.conf.all.disable_ipv6=1

Restrict netlink access

linux

Use firewall rules to restrict access to netlink sockets

iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to limit access to affected systems
Monitor for unusual netlink traffic patterns and memory access attempts

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisories. Vulnerable if running kernel before patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits or check with distribution's security update verification tools.

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing memory allocation errors or unusual netlink activity
System logs showing IPv6 address label operations

Network Indicators:

Unusual netlink traffic patterns
Multiple requests to ip6addrlbl_get function

SIEM Query:

source="kernel" AND ("ip6addrlbl" OR "ifaddrlmsg" OR "KMSAN: kernel-network-infoleak")

📊 Metadata

CVE ID: CVE-2022-49865

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-909

EPSS Score: 0.02% exploit probability (5.9th percentile)

Published: May 1, 2025

Last Updated: January 23, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49865, you might also want to check these: