CVE-2022-48938: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.

Affected products

• Linux Linux Kernel: before 5.10.103 (fixed in 5.10.103); from 5.11, before 5.15.26 (fixed in 5.15.26); from 5.16, before 5.16.12 (fixed in 5.16.12)

Published 2024-08-22. Last modified 2026-06-17.