CVE-2022-49066: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49066 affects the Linux kernel's virtual ethernet (veth) device driver. The vulnerability was discovered when a decapsulated packet is fed to a veth device with act_mirred, where skb_headlen() may be 0. This condition occurs because veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data, as __dev_forward_skb2() calls eth_type_trans() that unconditionally pulls ETH_HLEN bytes (Kernel Commit).

The vulnerability stems from a mismatch between data handling requirements in the veth driver's packet transmission path. When eth_type_trans() is called within __dev_forward_skb2(), it attempts to pull ETH_HLEN bytes unconditionally, but in cases where skb_headlen() is 0, this operation fails, triggering a kernel BUG at include/linux/skbuff.h:2328. The issue manifests in the call trace through veth_xmit() and ultimately leads to a kernel panic (Kernel Commit).

When triggered, this vulnerability causes a kernel panic, leading to system instability and potential denial of service. The issue occurs in the networking stack's core functionality, specifically affecting systems using virtual ethernet interfaces with certain packet processing configurations (Kernel Commit).

The vulnerability can be triggered when specific networking conditions are met, particularly when using veth devices in combination with act_mirred traffic control actions. The exploit path requires sending specially crafted packets through a virtual ethernet interface setup (Kernel Commit).

The issue has been fixed by adding a check using pskb_may_pull() to ensure veth_xmit() respects the ETH_HLEN constraint. The fix was implemented in the Linux kernel through commit 726e2c5929de841fdcef4e2bf995680688ae1b87, which modifies the veth driver to properly handle the packet buffer requirements (Kernel Commit).