PT-2025-8273 · Linux+4 · Linux Kernel+4

Stephen Rothwell · Published 2022-05-27 · Updated 2025-09-29 · CVE-2022-49339

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, related to the seg6 hmac init() function, which is annotated with init and exported using EXPORT SYMBOL. This combination is problematic because the .init.text section is freed after initialization, and modules cannot use symbols annotated with init. Access to a freed symbol may result in a kernel panic. The issue was previously undetected by modpost due to a decade-long bug, but a recent fix to modpost revealed the problem.

Recommendations Remove EXPORT SYMBOL from the seg6 hmac init() function, as the caller and callee belong to the same module, ipv6.ko. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

ALSA-2025_16880

BDU:2026-03494

CESA-2023_2951

CVE-2022-49339

RHSA-2023:2951

RHSA-2023:6583

RHSA-2023_2951

RHSA-2023_6583

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1343

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49339.json · Exploit
• https://git.kernel.org/stable/c/64aef8efe96c1616142c4476a05731306fc4494e · Patch
• https://git.kernel.org/stable/c/9ba4416b831eeb4d185e88e73488d1d21288e63a · Patch
• https://cve.org/CVERecord?id=CVE-2022-49339 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://git.kernel.org/stable/c/ab8b2c2de273ec1d698a18e399896a6febb5cda0 · Patch
• https://git.kernel.org/stable/c/5d9c1b081ad28c852a97e10dd75412546497694a · Patch
• https://git.kernel.org/stable/c/3e6de5037148c5a93a436b1e8d2edad3dac11755 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49339 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49339 · Vendor Advisory
• https://git.kernel.org/stable/c/5801f064e35181c71857a80ff18af4dbec3c5f5c · Patch
• https://git.kernel.org/stable/c/1084716f76c8045eadf92a9d9a62641f3c8d8c90 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory