CVE-2022-49967
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a data-race condition in the Linux kernel related to the bpf_jit_limit variable. While reading bpf_jit_limit, it can be changed concurrently via sysctl, which can cause inconsistent or torn reads because the variable is of type long. The fix involves adding a paired READ_ONCE() to prevent load-tearing and ensure safe concurrent access.
How can this vulnerability impact me? :
The vulnerability could lead to inconsistent or corrupted data being read from the bpf_jit_limit variable due to concurrent modifications, potentially causing unexpected behavior or instability in the kernel's BPF JIT functionality. This could affect system reliability or security depending on how BPF is used.