CVE-2022-3636

MediumCVSS 5.5

Published: 21/10/2022(UTC)Updated: 28/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

In the Linux kernel, a vulnerability was identified in the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c, in the Ethernet Handler component. Manipulation leads to a use-after-free. A patch is available, but no released kernel version was ever affected by this CVE.

Risk Assessment

The vulnerability could allow a local attacker to execute code in kernel context or cause a system crash, but the risk is low as it does not affect any released version.

Recommendation

Apply the available patch (commit 17a5f6a78dc7b8db385de346092d7d9f9dc24df6) in custom kernel builds containing this code.

Original NVD description (English source)

A vulnerability was identified in Linux Kernel 33fc42de33278b2b3ec6f3390512987bc29a62b7. This affects the function __mtk_ppe_check_skb of the file drivers/net/ethernet/mediatek/mtk_ppe.c of the component Ethernet Handler. Such manipulation leads to use after free. The name of the patch is 17a5f6a78dc7b8db385de346092d7d9f9dc24df6. It is best practice to apply a patch to resolve this issue. No released Linux Kernel version was ever affected by this CVE.