CVE-2022-47929

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c.

• CWE-476
• CWE-476

• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6Mailing List, Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=96398560f26aa07e8f2969d73c8197e6a6d10407Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html
• https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
• https://tldp.org/HOWTO/Traffic-Control-HOWTO/components.htmlThird Party Advisory
• https://www.debian.org/security/2023/dsa-5324Third Party Advisory
• https://www.spinics.net/lists/netdev/msg555705.htmlExploit, Mailing List, Third Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.6Mailing List, Patch, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=96398560f26aa07e8f2969d73c8197e6a6d10407Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html
• https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
• https://tldp.org/HOWTO/Traffic-Control-HOWTO/components.htmlThird Party Advisory
• https://www.debian.org/security/2023/dsa-5324Third Party Advisory
• https://www.spinics.net/lists/netdev/msg555705.htmlExploit, Mailing List, Third Party Advisory

Published

Jan 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4792The News & Blog Designer Pack WordPress plugin before 3.3 do…5.4
• CVE-2022-47924An high privileged attacker may pass crafted arguments to th…6.5
• CVE-2022-47925The validate JSON endpoint of the Secvisogram csaf-validator…7.5
• CVE-2022-47926AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/…9.8
• CVE-2022-47927An issue was discovered in MediaWiki before 1.35.9, 1.36.x t…5.5
• CVE-2022-47928In MISP before 2.4.167, there is XSS in the template file up…6.1
• CVE-2022-4793The Blog Designer WordPress plugin before 2.4.1 does not val…5.4
• CVE-2022-47930An issue was discovered in IO FinNet tss-lib before 2.0.0. T…6.8
• CVE-2022-47931IO FinNet tss-lib before 2.0.0 allows a collision of hash va…9.1
• CVE-2022-47932Brave Browser before 1.43.34 allowed a remote attacker to ca…6.5
• CVE-2022-47933Brave Browser before 1.42.51 allowed a remote attacker to ca…6.5
• CVE-2022-47934Brave Browser before 1.43.88 allowed a remote attacker to ca…6.5