Executive brief
A vulnerability in the Linux kernel's network tap driver could allow a local user to crash the system. The tap driver is a component used to bridge virtual machine networking with physical networks. An exploit of this flaw results in a 'kernel panic' or system crash, leading to a denial of service for the affected host and any hosted virtual services.
Technical details
A NULL pointer dereference exists in the Linux kernel tap driver within the tap_get_user function. When tap_get_user calls virtio_net_hdr_to_skb, the skb->dev field is not yet initialized (NULL). This leads to a crash when virtio_net_hdr_to_skb subsequently calls dev_parse_header_protocol, which attempts to access members of the NULL dev pointer (specifically header_ops). A local attacker with sufficient privileges to interact with tap devices can trigger this condition to cause a kernel oops and system denial of service. The issue was resolved by ensuring skb->dev is properly assigned before the virtio_net_hdr_to_skb call.
Affected products
- Linux Linux Kernel 4.14.226 to 4.15, 4.19.181 to 4.20, 5.4.106 to 5.5, 5.10.24 to 5.11, 5.11.7 to 5.12, 5.12.1 to 5.19.4
Timeline
- 2022-08-05: patched: Initial fix committed to mainline kernel.
- 2025-06-18: advisory: CVE published/updated.