CVE-2022-49957
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.15 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-908 | The product uses or accesses a resource that has not been initialized. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's kcm module where the function strp_init() was called in an incorrect order relative to a check on csk->sk_user_data. The issue was that strp_init() initialized certain work structures prematurely, and if sk_user_data was already in use, the strp->work state could be improperly handled. The fix involved moving the strp_init() call after the sk_user_data check to prevent unnecessary cancellation of freshly initialized work and avoid touching strp->work state when it shouldn't be modified. This also resolved a lockdep warning reported by syzbot.
How can this vulnerability impact me? :
The vulnerability could lead to improper handling of kernel work structures in the kcm module, potentially causing instability or unexpected behavior in the Linux kernel networking stack. This might result in kernel warnings or errors, and in some cases could affect system reliability or security, depending on how the kernel module is used.