cbcvebase.
CVE-2022-49814
published 2025-05-01

CVE-2022-49814: In the Linux kernel, the following vulnerability has been resolved: kcm: close race conditions on sk_receive_queue sk->sk_receive_queue is protected by skb…

PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.16%
5.4th percentile
In the Linux kernel, the following vulnerability has been resolved: kcm: close race conditions on sk_receive_queue sk->sk_receive_queue is protected by skb queue lock, but for KCM sockets its RX path takes mux->rx_lock to protect more than just skb queue. However, kcm_recvmsg() still only grabs the skb queue lock, so race conditions still exist. We can teach kcm_recvmsg() to grab mux->rx_lock too but this would introduce a potential performance regression as struct kcm_mux can be shared by multiple KCM sockets. So we have to enforce skb queue lock in requeue_rx_msgs() and handle skb peek case carefully in kcm_wait_data(). Fortunately, skb_recv_datagram() already handles it nicely and is widely used by other sockets, we can just switch to skb_recv_datagram() after getting rid of the unnecessary sock lock in kcm_recvmsg() and kcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets, so it is safe to get rid of this check too. I ran the original syzbot reproducer for 30 min without seeing any issue.

Affected

24 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.10-1 (bookworm)linux 6.0.10-1 (bookworm)
linuxlinux——
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 22f6b5d47396b4287662668ee3f5c1f766cb425922f6b5d47396b4287662668ee3f5c1f766cb4259
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < d9ad4de92e184b19bcae4da10dac0275abf83931d9ad4de92e184b19bcae4da10dac0275abf83931
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < ce57d6474ae999a3b2d442314087473a646a65c7ce57d6474ae999a3b2d442314087473a646a65c7
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 4154b6afa2bd639214ff259d912faad984f7413a4154b6afa2bd639214ff259d912faad984f7413a
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < bf92e54597d842da127c59833b365d6faeeaf020bf92e54597d842da127c59833b365d6faeeaf020
linuxlinux>= ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 < 5121197ecc5db58c07da95eb1ff82b98b121a2215121197ecc5db58c07da95eb1ff82b98b121a221
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.158-15.10.158-1
linuxlinux_kernel>= 0 < 6.0.10-16.0.10-1
linuxlinux_kernel>= 0 < 6.0.10-16.0.10-1
linuxlinux_kernel>= 0 < 6.0.10-16.0.10-1
linuxlinux_kernel>= 4.15 < 4.19.2674.19.267
linuxlinux_kernel>= 4.20 < 5.4.2255.4.225
linuxlinux_kernel>= 4.6 < 4.14.3004.14.300
linuxlinux_kernel>= 5.11 < 5.15.805.15.80
linuxlinux_kernel>= 5.16 < 6.0.106.0.10
linuxlinux_kernel>= 5.5 < 5.10.1565.10.156

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.