PT-2025-25883 · Linux+2 · Linux Kernel+2

Published 2022-08-31 · Updated 2025-11-14 · CVE-2022-49957

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the kcm module. The issue involved the incorrect ordering of the strp init() function call, which led to unnecessary initialization and potential issues with the strp->work state. This problem also caused a lockdep warning reported by syzbot. The fix involves moving the strp init() call after the csk->sk user data check to prevent touching psock->strp when sk user data is already used by KCM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Improper Initialization

Weakness Enumeration

CWE-908

CWE-665

Related Identifiers

BDU:2026-02658

CVE-2022-49957

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:02322-1

SUSE-SU-2025:02334-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02334-1

SUSE-SU-2025_02537-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 738

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49957.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-49957 · Security Note
• https://git.kernel.org/stable/c/0946ff31d1a8778787bf6708beb20f38715267cc · Patch
• https://ubuntu.com/security/CVE-2022-49957 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02334-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02537-1 · Vendor Advisory
• https://git.kernel.org/stable/c/55fb8c3baa8071c5d533a9ad48624e44e2a04ef5 · Patch
• https://git.kernel.org/stable/c/1b6666964ca1de93a7bf06e122bcf3616dbd33a9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49957 · Vendor Advisory
• https://git.kernel.org/stable/c/f865976baa85915c7672f351b74d5974b93215f6 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49957 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02264-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49957 · Vendor Advisory
• https://git.kernel.org/stable/c/a8a0c321319ad64a5427d6172cd9c23b4d6ca1e8 · Patch
• https://git.kernel.org/stable/c/8fc29ff3910f3af08a7c40a75d436b5720efe2bf · Patch