PT-2025-25924 · Linux+2 · Linux Kernel+2

Published 2022-08-25 · Updated 2025-06-19 · CVE-2022-49998

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.16.0-rc6

Description The issue is related to the rxrpc's sendmsg implementation in the Linux kernel, where three bugs have been identified and fixed. These bugs concern locking mechanisms, specifically the release of the socket lock and the call mutex. Without the fix, a warning about a bad unlock balance can be triggered, potentially leading to issues. The problem arises from the way rxrpc new client call(), rxrpc wait for tx window intr(), and rxrpc send data() handle locking and unlocking, which can lead to a situation where a lock is released without being held.

Recommendations For Linux kernel versions prior to 5.16.0-rc6, update to a version that includes the fix for the rxrpc's sendmsg implementation to resolve the locking issues. As a temporary workaround, consider implementing different locks for sendmsg() and recvmsg() to prevent recvmsg() from waiting for sendmsg(), although this might lead to recvmsg() returning MSG EOR before a sendmsg() to the same call returns.

Exploit

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2026-02571

CVE-2022-49998

RHSA-2023:2458

RHSA-2023_2458

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49998.json · Exploit
• https://git.kernel.org/stable/c/091dc91e119fdd61432347231724f4e861c6b465 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49998 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02571 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49998 · Vendor Advisory
• https://git.kernel.org/stable/c/79e2ca7aa96e80961828ab6312264633b66183cc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49998 · Security Note
• https://ubuntu.com/security/CVE-2022-49998 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49998 · Vendor Advisory
• https://git.kernel.org/stable/c/2bc769b8edb158be7379d15f36e23d66cf850053 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49998 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49998 · Vendor Advisory
• https://git.kernel.org/stable/c/b0f571ecd7943423c25947439045f0d352ca3dbf · Patch
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.6 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note