PT-2025-8077 · Linux+1 · Linux Kernel+1

Marc Dionne · Published 2022-03-30 · Updated 2025-03-03 · CVE-2022-49149

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A issue in the Linux kernel has been resolved, related to the rxrpc call struct timer. The timer can be started from packet input routines running in softirq mode with only the RCU read lock held, allowing the call to be destroyed at the same time a packet is processed, causing the timer to be restarted after being stopped. This can lead to an oops if the timer is deallocated first. The issue is fixed by taking a ref on the rxrpc call struct and passing it to the timer, which is then passed to the call's work item when queued.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2026-03535

CVE-2022-49149

Affected Products

Astra Linux

Linux Kernel

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49149.json · Exploit
• https://ubuntu.com/security/CVE-2022-49149 · Vendor Advisory
• https://git.kernel.org/stable/c/4a7f62f91933c8ae5308f9127fd8ea48188b6bc3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49149 · Vendor Advisory
• https://git.kernel.org/stable/c/8cbf4ae7a2833767d63114573e5f9a45740cc975 · Patch
• https://git.kernel.org/stable/c/051360e51341cd17738d82c15a8226010c7cb7f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49149 · Security Note
• https://bdu.fstec.ru/vul/2026-03535 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49149 · Vendor Advisory
• https://git.kernel.org/stable/c/54df5a37f1d951ed27fd47bf9b15a42279582110 · Patch
• https://git.kernel.org/stable/c/5e3c11144e557a9dbf9a2f6abe444689ef9d8aae · Patch
• https://cve.org/CVERecord?id=CVE-2022-49149 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49149 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49149 · Vendor Advisory
• ttps://access.redhat.com/security/cve/CVE-2022-49149 · Note