cbcvebase.
CVE-2022-49634
published 2025-02-26

CVE-2022-49634: In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data-races in proc_dou8vec_minmax(). A sysctl variable is accessed…

PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.18%
8.1th percentile
In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data-races in proc_dou8vec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_dou8vec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dou8vec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side.

Affected

13 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.18.14-1 (bookworm)linux 5.18.14-1 (bookworm)
linuxlinux
linuxlinux>= 389dab6142d742f91010f38de0f1f2f440b97e1b < f177b382c33900d0e5a9766493c11a1074076f78f177b382c33900d0e5a9766493c11a1074076f78
linuxlinux>= cb9444130662c6c13022579c861098f212db2562 < e58b02e445463065b4078bf621561da75197853fe58b02e445463065b4078bf621561da75197853f
linuxlinux>= cb9444130662c6c13022579c861098f212db2562 < 5f776daef0b5354615ec4b4234cd9539ca05f2735f776daef0b5354615ec4b4234cd9539ca05f273
linuxlinux>= cb9444130662c6c13022579c861098f212db2562 < 7dee5d7747a69aa2be41f04c6a7ecfe3ac8cdf187dee5d7747a69aa2be41f04c6a7ecfe3ac8cdf18
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 5.18.14-15.18.14-1
linuxlinux_kernel>= 0 < 5.18.14-15.18.14-1
linuxlinux_kernel>= 0 < 5.18.14-15.18.14-1
linuxlinux_kernel>= 5.13 < 5.15.565.15.56
linuxlinux_kernel>= 5.16 < 5.18.135.18.13

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.