PT-2025-8354 · Linux+2 · Linux Kernel+2

Syzbot · Published 2022-01-01 · Updated 2026-05-26 · CVE-2022-49420

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the data-race issue in ip6 datagram connect and udpv6 sendmsg

Description A data-race issue exists in the Linux kernel, specifically in the ip6 datagram connect and udpv6 sendmsg functions. This issue is caused by the lockless nature of UDP sendmsg(), which reads sk->sk bound dev if while this field can be changed by another thread. The Kernel Concurrency Sanitizer reported this issue, which has minor consequences.

Recommendations For Linux kernel versions prior to the fixed version, consider applying patches that add annotations to avoid KCSAN splats for UDP, such as the one that adds minimal annotations to potential lockless readers. As a temporary workaround, consider restricting access to the udpv6 sendmsg function until a patch is available.

Exploit

Fix

Improper Access Control

Information Disclosure

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-200

CWE-266

Related Identifiers

AZL-68621

BDU:2026-04034

CVE-2022-49420

OESA-2025-1963

OESA-2025-1964

SUSE-SU-2025:01983-1

SUSE-SU-2025_01983-1

Affected Products

Debian

Linux Kernel

Suse

References · 401

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49420.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-38498 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21700 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38386 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38222 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49183 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38371 · Security Note
• https://ubuntu.com/security/CVE-2022-49420 · Vendor Advisory
• https://git.kernel.org/stable/c/20b2f61797873a2b18b5ff1a304ad2674fa1e0a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38332 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38387 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4458 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01983-1 · Vendor Advisory