PT-2025-8137 · Linux+2 · Linux Kernel+2

Wang Yufen · Published 2025-02-26 · Updated 2025-04-16 · CVE-2022-49209

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the bpf and sockmap components. The issue occurs when the tcp bpf sendmsg() function is running while the socket message buffer is full, and the sk msg alloc() function returns an -ENOMEM error. This can cause a memory leak if partial memory has been allocated. The issue is resolved by using the sk msg trim() function to release the allocated memory. Other call paths, such as tls sw sendmsg(), may also be affected. The issue can cause warning messages to be printed to the system log, including warnings about CPU and PID errors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-49209

SUSE-SU-2025:1176-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1293-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1293-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1454

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49209.json · Exploit
• https://git.kernel.org/stable/c/f677328f05f52d535cbdc15cb04476db49477eb4 · Patch
• https://git.kernel.org/stable/c/de3a8d8fab0710186f7864ec812836d8d70da3c9 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1293-1 · Vendor Advisory
• https://git.kernel.org/stable/c/bec34a91eba3483e1830c02bdd36f8f968642047 · Patch
• https://osv.dev/vulnerability/CVE-2022-49209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49209 · Security Note
• https://git.kernel.org/stable/c/9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8 · Patch
• https://git.kernel.org/stable/c/d0b85dfc6f01d26808e2576c6537c131b590e270 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49209 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49209 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49209 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49209 · Security Note