PT-2025-18555 · Linux+1 · Linux Kernel+1

Published 2025-05-01 · Updated 2025-05-02 · CVE-2022-49838

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A crash was reported due to list del corruption in the Linux kernel's sctp module. The issue occurs when the last fragment of a message is dequeued from the out curr stream in sctp prsctp prune unsent(), but out curr is not set to NULL. Normally, stream->out curr should be set to NULL once all fragments of the current message are dequeued, as seen in sctp sched dequeue done(). However, in sctp prsctp prune unsent(), this is not done because it is not a proper dequeue. The problem is solved by setting out curr to NULL when the last fragment of the current message is dequeued from the out curr stream in sctp prsctp prune unsent().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2026-05813

CVE-2022-49838

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49838.json · Exploit
• https://git.kernel.org/stable/c/2f201ae14ae0f91dbf1cffea7bb1e29e81d4d108 · Patch
• https://git.kernel.org/stable/c/2ea600b598dd3e061854dd4dd5b4c815397dfcea · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49838 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49838 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49838 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05813 · Security Note
• https://git.kernel.org/stable/c/e27458b18b35caee4b27b37a4a9c503b93cae5cc · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49838 · Vendor Advisory
• https://git.kernel.org/stable/c/3eff34e01062ec08fbb45ce2baaaa644550be821 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49838 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49838 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49838 · Vendor Advisory
• https://twitter.com/CVEnew/status/1917950884895666461 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note