---
cve: "CVE-2022-48938"
severity: "LOW"
cvss: 3.1
epss: "21%"
vendor: "Linux"
kev: false
exploited: false
published: "2024-08-22 04:15:17"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-08T16:01:40+02:00"
---

# CVE-2022-48938

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

CDC-NCM: avoid overflow in sanity checking

A broken device may give an extreme offset like 0xFFF0
and a reasonable length for a fragment. In the sanity
check as formulated now, this will create an integer
overflow, defeating the sanity check. Both offset
and offset + len need to be checked in such a manner
that no overflow can occur.
And those quantities should be unsigned.

## Patch verfügbar (OSV)

- Kernel ≥ 4.19.323
- Kernel ≥ 5.4.285
- Kernel ≥ 5.10.103
- Kernel ≥ 5.15.26
- Kernel ≥ 5.16.12

## Referenzen

- <https://git.kernel.org/stable/c/a612395c7631918e0e10ea48b9ce5ab4340f26a6>
- <https://git.kernel.org/stable/c/9957fbf34f52a4d8945d1bf39aae400ef9a11246>
- <https://git.kernel.org/stable/c/69560efa001397ebb8dc1c3e6a3ce00302bb9f7f>
- <https://git.kernel.org/stable/c/49909c9f8458cacb5b241106cba65aba5a6d8f4c>
- <https://git.kernel.org/stable/c/7b737e47b87589031f0d4657f6d7b0b770474925>
- <https://git.kernel.org/stable/c/8d2b1a1ec9f559d30b724877da4ce592edc41fdc>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2022-48938) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_