PT-2025-18531 · Linux+2 · Linux Kernel+2

Published 2022-11-15 · Updated 2025-07-16 · CVE-2022-49814

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition issue has been resolved in the Linux kernel related to KCM sockets. The sk->sk receive queue is protected by the skb queue lock, but for KCM sockets, the RX path takes mux->rx lock to protect more than just the skb queue. However, kcm recvmsg() still only grabs the skb queue lock, leading to potential race conditions. To address this, the code has been modified to enforce the skb queue lock in requeue rx msgs() and handle the skb peek case carefully in kcm wait data(). The skb recv datagram() function is used to handle this case, and the unnecessary sock lock in kcm recvmsg() and kcm splice read() has been removed.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the race condition in KCM sockets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2026-03724

CVE-2022-49814

OESA-2025-1726

SUSE-SU-2025:02334-1

SUSE-SU-2025_02334-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 308

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49814.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-49814 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53125 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49814 · Security Note
• https://git.kernel.org/stable/c/bf92e54597d842da127c59833b365d6faeeaf020 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-50222 · Security Note
• https://git.kernel.org/stable/c/d9ad4de92e184b19bcae4da10dac0275abf83931 · Patch
• https://ubuntu.com/security/CVE-2022-49814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50080 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1726 · Vendor Advisory
• https://git.kernel.org/stable/c/f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49981 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49814 · Vendor Advisory
• https://git.kernel.org/stable/c/22f6b5d47396b4287662668ee3f5c1f766cb4259 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49814 · Vendor Advisory