CVE-2022-49664

In the Linux kernel, the following vulnerability has been resolved: tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_link_is_up+0x5/0x10 [tipc] [] Call Trace: [] <IRQ> [] tipc_bcast_rcv+0xa2/0x190 [tipc] [] tipc_node_bc_rcv+0x8b/0x200 [tipc] [] tipc_rcv+0x3af/0x5b0 [tipc] [] tipc_udp_recv+0xc7/0x1e0 [tipc] It was caused by the 'l' passed into tipc_bcast_rcv() is NULL. When it creates a node in tipc_node_check_dest(), after inserting the new node into hashtable in tipc_node_create(), it creates the bc link. However, there is a gap between this insert and bc link creation, a bc packet may come in and get the node from the hashtable then try to dereference its bc link, which is NULL. This patch is to fix it by moving the bc link creation before inserting into the hashtable. Note that for a preliminary node becoming "real", the bc link creation should also be called before it's rehashed, as we don't create it for preliminary nodes.

• CWE-476
• CWE-476

• https://git.kernel.org/stable/c/35fcb2ba35b4d9b592b558c3bcc6e0d90e213588Patch
• https://git.kernel.org/stable/c/456bc338871c4a52117dd5ef29cce3745456d248Patch
• https://git.kernel.org/stable/c/cb8092d70a6f5f01ec1490fce4d35efed3ed996cPatch
• https://git.kernel.org/stable/c/e52910e671f58c619e33dac476b11b35e2d3ab6fPatch

Published

Feb 26, 2025

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-49659In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-4966A vulnerability was found in sequentech admin-console up to …3.5
• CVE-2022-49660Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-49661In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49662In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49663In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49665In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49666In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49667In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-49668In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49669In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-4967strongSwan versions 5.9.2 through 5.9.5 are affected by auth…6.5