{
  "cveId": "CVE-2022-49863",
  "url": "https://patchblox.com/security/cve/CVE-2022-49863",
  "summary": "CVE-2022-49863 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49863, released May 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  can: af_can: fix NULL pointer dereference in can...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  can: af_can: fix NULL pointer dereference in can_rx_register()  It causes NULL pointer dereference when testing as following: (a) use syscall(__NR_socket, 0x10ul, 3ul, 0) to create netlink socket. (b) use syscall(__NR_sendmsg, ...) to create bond link device and vxcan     link device, and bind vxcan device to bond device (can also use     ifenslave command to bind vxcan device to bond device). (c) use syscall(__NR_socket, 0x1dul, 3ul, 1) to create CAN socket. (d) use syscall(__NR_bind, ...) to bind the bond device to CAN socket.  The bond device invokes the can-raw protocol registration interface to receive CAN packets. However, ml_priv is not allocated to the dev, dev_rcv_lists is assigned to NULL in can_rx_register(). In this case, it will occur the NULL pointer dereference issue.  The following is the stack information: BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 122a4067 P4D 122a4067 PUD 1223c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP RIP: 0010:can_rx_register\u002B0x12d/0x1e0 Call Trace: \u003CTASK\u003E raw_enable_filters\u002B0x8d/0x120 raw_enable_allfilters\u002B0x3b/0x130 raw_bind\u002B0x118/0x4f0 __sys_bind\u002B0x163/0x1a0 __x64_sys_bind\u002B0x1e/0x30 do_syscall_64\u002B0x35/0x80 entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd \u003C/TASK\u003E",
  "published": "2025-05-01T15:16:11Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00202,
  "epssPercentile": 0.10139,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49863",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49863",
      "released": "2025-05-01T15:16:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49863",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49863",
      "released": "2025-05-01T15:16:11Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49863",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49863",
      "released": "2025-05-01T15:16:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}