PT-2025-8279 · Linux+3 · Linux Kernel+3

Stephen Rothwell · Published 2022-06-06 · Updated 2025-09-29 · CVE-2022-49345

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the xfrm4 protocol init() function, which was annotated with init and exported using EXPORT SYMBOL. This combination is problematic because the .init.text section is freed after initialization, and modules cannot use symbols annotated with init, potentially leading to a kernel panic. The issue was detected after a fix was applied to modpost, a tool that had been broken for a decade.

Recommendations Remove EXPORT SYMBOL from the xfrm4 protocol init() function to prevent the vulnerability, as the only in-tree call site is never compiled as modular.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

ALSA-2025_16880

BDU:2026-03495

CVE-2022-49345

RHSA-2023:2458

RHSA-2023_2458

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Red Hat

Suse

References · 1345

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49345.json · Exploit
• https://git.kernel.org/stable/c/be3884d5cd04ccd58294b83a02d70b7c5fca19d3 · Patch
• https://git.kernel.org/stable/c/31f3c6a4dcd3260a386e62cef2d5b36e902600a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49345 · Security Note
• https://git.kernel.org/stable/c/2b253fbc9f7b5db18d716436bdcf8ecef09fd63d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49345 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://git.kernel.org/stable/c/e53cd3814504b2cadaba4d5a8a07eeea9ddacd03 · Patch
• https://git.kernel.org/stable/c/4a388f08d8784af48f352193d2b72aaf167a57a1 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49345 · Security Note
• https://git.kernel.org/stable/c/85a055c03691e51499123194a14a0c249cf33227 · Patch
• https://git.kernel.org/stable/c/ef6d2354de238b065d8799c80da4be9a6af18e39 · Patch
• https://git.kernel.org/stable/c/e04d59cfe0c0129df7aba7ef7bb17b96be2a64f2 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49345 · Vendor Advisory