CVE-2022-48851

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48851", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.913Z", "datePublished": "2024-07-16T12:25:18.488Z", "dateUpdated": "2026-08-05T08:52:38.698Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:38.698Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can't dereference it to\nsave the skb->len."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - gdm_lte_rx() is the RX completion path of the GDM724x LTE WWAN netdev; a remote peer that can deliver packets over the cellular/IP path causes the modem to submit LTE_RX_SDU bulk data, which flows USB RX \u2192 do_rx() \u2192 gdm_lte_receive_pkt() \u2192 gdm_lte_netif_rx() \u2192 gdm_lte_rx() on every received SDU\u2014ordinary network traffic, not USB-descriptor framing.\nAC:L - Every successful receive that returns NET_RX_SUCCESS from netif_rx_ni() takes the else branch and dereferences skb->len after the skb has been consumed/freed by backlog softirq processing; the attacker only needs to deliver packets and needs no race or uncontrollable victim state.\nPR:N - Inbound LTE SDUs are processed with no host authentication, credentials, or capabilities; a remote network peer needs no OS account on the target.\nUI:N - Once the modem is attached and the lte*pdn* interfaces are up (typical always-on LTE/IoT deployment), packet delivery alone triggers the path with no mount, file-open, or other victim action.\nS:U - The use-after-free corrupts/uses host kernel skb/stats state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of the skb object after netif_rx_ni(); per scoring guidance a UAF enables heap reuse and arbitrary kernel memory disclosure (the freed skb->len read also feeds visible rx_bytes stats).\nI:H - Use-after-free of a slab skb is memory corruption that, under the higher-severity rule, is treated as enabling heap spray and write/control-flow hijack primitives in kernel context.\nA:H - Use-after-free of a consumed skb can oops/panic the kernel (and UAFs are scored A:H even when not fully exploited); a remote peer can retrigger it per received packet."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/gdm724x/gdm_lte.c"], "versions": [{"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "6dc7b87c62423bfa68139fe95e85028aab584c9a", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "83a9c886c2b5a0d28c0b37e1736b47f38d61332a", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "48ecdf3e29a6e514e8196691589c7dfc6c4ac169", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "403e3afe241b62401de1f8629c9c6b9b3d69dbff", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "6d9700b445098dbbce0caff4b8cfca214cf1e757", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "1fb9dd3787495b4deb0efe66c58306b65691a48f", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "d39dc79513e99147b4c158a8a9e46743e23944f5", "status": "affected", "versionType": "git"}, {"version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "fc7f750dc9d102c1ed7bbe4591f991e770c99033", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/staging/gdm724x/gdm_lte.c"], "versions": [{"version": "3.12", "status": "affected"}, {"version": "0", "lessThan": "3.12", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.307", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.272", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.235", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.185", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.106", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.29", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.15", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "4.9.307"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "4.14.272"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "4.19.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.4.185"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.10.106"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.15.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.16.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"}, {"url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"}, {"url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"}, {"url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"}, {"url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"}, {"url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"}, {"url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"}, {"url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"}], "title": "staging: gdm724x: fix use after free in gdm_lte_rx()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.775Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:26:05.468000Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:08.533Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.775Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:26:05.468000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:20.933Z"}}], "cna": {"title": "staging: gdm724x: fix use after free in gdm_lte_rx()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - gdm_lte_rx() is the RX completion path of the GDM724x LTE WWAN netdev; a remote peer that can deliver packets over the cellular/IP path causes the modem to submit LTE_RX_SDU bulk data, which flows USB RX \u2192 do_rx() \u2192 gdm_lte_receive_pkt() \u2192 gdm_lte_netif_rx() \u2192 gdm_lte_rx() on every received SDU\u2014ordinary network traffic, not USB-descriptor framing.\nAC:L - Every successful receive that returns NET_RX_SUCCESS from netif_rx_ni() takes the else branch and dereferences skb->len after the skb has been consumed/freed by backlog softirq processing; the attacker only needs to deliver packets and needs no race or uncontrollable victim state.\nPR:N - Inbound LTE SDUs are processed with no host authentication, credentials, or capabilities; a remote network peer needs no OS account on the target.\nUI:N - Once the modem is attached and the lte*pdn* interfaces are up (typical always-on LTE/IoT deployment), packet delivery alone triggers the path with no mount, file-open, or other victim action.\nS:U - The use-after-free corrupts/uses host kernel skb/stats state within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of the skb object after netif_rx_ni(); per scoring guidance a UAF enables heap reuse and arbitrary kernel memory disclosure (the freed skb->len read also feeds visible rx_bytes stats).\nI:H - Use-after-free of a slab skb is memory corruption that, under the higher-severity rule, is treated as enabling heap spray and write/control-flow hijack primitives in kernel context.\nA:H - Use-after-free of a consumed skb can oops/panic the kernel (and UAFs are scored A:H even when not fully exploited); a remote peer can retrigger it per received packet."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "6dc7b87c62423bfa68139fe95e85028aab584c9a", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "83a9c886c2b5a0d28c0b37e1736b47f38d61332a", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "48ecdf3e29a6e514e8196691589c7dfc6c4ac169", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "403e3afe241b62401de1f8629c9c6b9b3d69dbff", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "6d9700b445098dbbce0caff4b8cfca214cf1e757", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "1fb9dd3787495b4deb0efe66c58306b65691a48f", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "d39dc79513e99147b4c158a8a9e46743e23944f5", "versionType": "git"}, {"status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "lessThan": "fc7f750dc9d102c1ed7bbe4591f991e770c99033", "versionType": "git"}], "programFiles": ["drivers/staging/gdm724x/gdm_lte.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"status": "unaffected", "version": "0", "lessThan": "3.12", "versionType": "semver"}, {"status": "unaffected", "version": "4.9.307", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.272", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.235", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.185", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.106", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.29", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.15", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/staging/gdm724x/gdm_lte.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"}, {"url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"}, {"url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"}, {"url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"}, {"url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"}, {"url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"}, {"url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"}, {"url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can't dereference it to\nsave the skb->len."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.307", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.272", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.235", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.185", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.106", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.29", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.15", "versionStartIncluding": "3.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "3.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:38.698Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48851", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:38.698Z", "dateReserved": "2024-07-16T11:38:08.913Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-16T12:25:18.488Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/staging/gdm724x/gdm_lte.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6dc7b87c62423bfa68139fe95e85028aab584c9a", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "83a9c886c2b5a0d28c0b37e1736b47f38d61332a", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "48ecdf3e29a6e514e8196691589c7dfc6c4ac169", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "403e3afe241b62401de1f8629c9c6b9b3d69dbff", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "6d9700b445098dbbce0caff4b8cfca214cf1e757", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "1fb9dd3787495b4deb0efe66c58306b65691a48f", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "d39dc79513e99147b4c158a8a9e46743e23944f5", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}, {"lessThan": "fc7f750dc9d102c1ed7bbe4591f991e770c99033", "status": "affected", "version": "61e121047645122c47714fcda684d0ee67f444af", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/staging/gdm724x/gdm_lte.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.12"}, {"lessThan": "3.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.307", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.272", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.235", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.185", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.106", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.29", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.15", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C646FCEC-8D9D-4160-A402-1488A1906083", "versionEndExcluding": "4.9.307", "versionStartIncluding": "3.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0FA2C5-4E50-48A6-9D72-7C133B60EF05", "versionEndExcluding": "4.14.272", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8671D74-E8CD-4E41-A93F-3E3E88125D16", "versionEndExcluding": "4.19.235", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B374BFBF-C879-4A72-921F-C850CF7DFB99", "versionEndExcluding": "5.4.185", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A4F38AC-99A2-48DF-B132-C9F785B309B8", "versionEndExcluding": "5.10.106", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "15DC6588-B28F-4637-9A1E-3753B34A40CF", "versionEndExcluding": "5.15.29", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "83FDEDF2-0E19-4879-91FD-171E66D1B335", "versionEndExcluding": "5.16.15", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: gdm724x: fix use after free in gdm_lte_rx()\n\nThe netif_rx_ni() function frees the skb so we can't dereference it to\nsave the skb->len."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: staging: gdm724x: corrige el use after free en gdm_lte_rx() La funci\u00f3n netif_rx_ni() libera el skb para que no podamos desreferenciarlo para guardar el skb->len."}], "id": "CVE-2022-48851", "lastModified": "2026-08-04T10:17:24.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48851", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:26:05.468000Z", "version": "2.0.3"}}]}, "published": "2024-07-16T13:15:12.247", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: staging: gdm724x: fix use after free in gdm_lte_rx()", "id": "2298192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298192"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nstaging: gdm724x: fix use after free in gdm_lte_rx()\nThe netif_rx_ni() function frees the skb so we can't dereference it to\nsave the skb->len."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-48851", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48851\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48851\nhttps://lore.kernel.org/linux-cve-announce/2024071625-CVE-2022-48851-4dad@gregkh/T"], "threat_severity": "Moderate"}

{}