{"id":"CVE-2022-49092","revision":null,"records":[{"revision":"1c5144bbaab04b7cb8f2b0da6f0c4d7d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2022-49092","aliases":[],"title":"net: ipv4: fix route with nexthop object delete warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix route with nexthop object delete warning\n\nFRR folks have hit a kernel warning[1] while deleting routes[2] which is\ncaused by trying to delete a route pointing to a nexthop id without\nspecifying nhid but matching on an interface. That is, a route is found\nbut we hit a warning while matching it. The warning is from\nfib_info_nh() in include/net/nexthop.h because we run it on a fib_info\nwith nexthop object. The call chain is:\n inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a\nnexthop fib_info and also with fc_oif set thus calling fib_info_nh on\nthe fib_info and triggering the warning). The fix is to not do any\nmatching in that branch if the fi has a nexthop object because those are\nmanaged separately. I.e. we should match when deleting without nh spec and\nshould fail when deleting a nexthop route with old-style nh spec because\nnexthop objects are managed separately, e.g.:\n $ ip r show 1.2.3.4/32\n 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0\n\n $ ip r del 1.2.3.4/32\n $ ip r del 1.2.3.4/32 nhid 12\n <both should work>\n\n $ ip r del 1.2.3.4/32 dev dummy0\n <should fail with ESRCH>\n\n[1]\n [  523.462226] ------------[ cut here ]------------\n [  523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460\n [  523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep binfmt_misc xfs vfat fat squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(POE) intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm snd_hda_intel edac_mce_amd\n [  523.462274]  videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi bluetooth snd_usb_audio snd_hda_codec mac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd snd_rawmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc snd_pcm kvm iwlwifi snd_timer drm_kms_helper snd cfg80211 cec soundcore irqbypass rapl wmi_bmof i2c_piix4 rfkill k10temp pcspkr acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core wmi ipmi_devintf ipmi_msghandler fuse\n [  523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P           OE     5.16.18-200.fc35.x86_64 #1\n [  523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/MPG X570 GAMING EDGE WIFI (MS-7C37), BIOS 1.C0 10/29/2020\n [  523.462303] RIP: 0010:fib_nh_match+0x210/0x460\n [  523.462304] Code: 7c 24 20 48 8b b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff ff ff <0f> 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00\n [  523.462306] RSP: 0018:ffffaa53d4d87928 EFLAGS: 00010286\n [  523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX: ffffaa53d4d87bb0\n [  523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff920ed380\n [  523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000000000\n [  523.462310] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000031\n [  523.462310] R13: 0000000000000020 R14: 0000000000000000 R15: ffff9e3d331054e0\n [  523.462311] FS:  00007f2455\n---truncated---","state":0,"publishedAt":"2025-02-26T01:54:47.172+00:00","modifiedAt":"2026-10-15T21:21:06.657+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/fib_semantics.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56\",\n                            \"lessThan\": \"f5064531c23ad646da7be8b938292b00a7e61438\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56\",\n                            \"lessThan\": \"63ea57478aaa3e06a597081a0f537318fc04e49f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56\",\n                            \"lessThan\": \"907c97986d6fa77318d17659dd76c94b65dd27c5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56\",\n                            \"lessThan\": \"dcd689f9e2640c992f94eae9955b106f71c6825d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56\",\n                            \"lessThan\": \"f8db5743d09523c0bb35f16e13691e3b7eb5dba0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c7e8084fd467ddb2b0e6c6011f9c1064afb7e56\",\n                            \"lessThan\": \"6bf92d70e690b7ff12b24f4bfff5e5434d019b82\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/fib_semantics.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.189\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.111\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.34\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.16.20\",\n                            \"lessThanOrEqual\": \"5.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.17.3\",\n                            \"lessThanOrEqual\": \"5.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.18\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/f5064531c23ad646da7be8b938292b00a7e61438","https://git.kernel.org/stable/c/63ea57478aaa3e06a597081a0f537318fc04e49f","https://git.kernel.org/stable/c/907c97986d6fa77318d17659dd76c94b65dd27c5","https://git.kernel.org/stable/c/dcd689f9e2640c992f94eae9955b106f71c6825d","https://git.kernel.org/stable/c/f8db5743d09523c0bb35f16e13691e3b7eb5dba0","https://git.kernel.org/stable/c/6bf92d70e690b7ff12b24f4bfff5e5434d019b82"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49092","license":"CVE Program Terms of Use","key":"cve-program:CVE-2022-49092","identifiers":["CVE-2022-49092"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T14:04:00.1516715+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T14:04:00.1516715+00:00","lastSuccessAt":"2026-11-09T14:04:00.2969466+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.2969495+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-63bead6b33209140263fb436f2f7924cdf0a57ddb97fc634114a22ac37965cfc","complete":true,"records":421444,"lastAttemptAt":"2026-11-09T14:02:14.5012261+00:00","lastSuccessAt":"2026-11-09T14:02:14.4549407+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:02:14.5012261+00:00","snapshotPublishedAt":"2026-11-09T13:24:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4fd8047eb31a4bcbbcf88601a1c55e9e","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T14:16:13.6696219+00:00","lastSuccessAt":"2026-11-09T14:16:13.665+00:00","error":"10 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T14:16:13.665+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13697,"expectedIdentifiers":13707,"failedIdentifiers":10},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T14:04:00.1516715+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T14:04:00.1516715+00:00","lastSuccessAt":"2026-11-09T14:04:00.2978136+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.297814+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fec5a400f2004099a6ceb2e015ba7713","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T14:04:00.8740665+00:00","lastSuccessAt":"2026-11-09T13:04:37.338+00:00","error":null,"lastVerifiedAt":"2026-11-09T13:04:37.338+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T14:04:00.1058982+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.1058982+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T14:02:14.6544671+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:02:14.6544671+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T14:04:00.1196922+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:04:00.1196922+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-0a2950eb931e2cbd521c1ee48327cd287727b9b342d55a1210c0101010ad92b5","complete":true,"records":231299,"lastAttemptAt":"2026-11-09T14:03:59.9741082+00:00","lastSuccessAt":"2026-11-09T14:03:58.6011989+00:00","error":null,"lastVerifiedAt":"2026-11-09T14:03:59.9741082+00:00","snapshotPublishedAt":"2026-11-09T13:48:25+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}