PT-2025-8390 · Linux+1 · Linux Kernel+1

Syzbot · Published 2022-05-19 · Updated 2025-02-28 · CVE-2022-49456

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0-rc5-syzkaller-01392-g01f4685797a5

Description A vulnerability in the Linux kernel has been resolved. The issue was related to the removal of the rcu read lock in the bond ethtool get ts info() function, which could be called via setsockopt without holding the rcu lock. This vulnerability was identified by syzbot and is related to the bonding driver. The vulnerability could potentially cause issues with the bonding driver when removing the rcu read lock.

Recommendations For Linux kernel versions prior to 5.18.0-rc5-syzkaller-01392-g01f4685797a5, apply the fix by adding rcu read lock and taking a reference on the real dev in the bond ethtool get ts info() function.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2026-04027

CVE-2022-49456

Affected Products

Astra Linux

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49456.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-49456 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49456 · Vendor Advisory
• https://git.kernel.org/stable/c/1b66a533c47d29b38af8e05fbb53b609a5ba3a4e · Patch
• https://bdu.fstec.ru/vul/2026-04027 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49456 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49456 · Vendor Advisory
• https://git.kernel.org/stable/c/85eed460681da71b359ed906bce4d800081db854 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49456 · Security Note
• https://git.kernel.org/stable/c/9b80ccda233fa6c59de411bf889cc4d0e028f2c7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49456 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49456 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2025022600-CVE-2022-49456-2bf4@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/linus/9b80ccda233fa6c59de411bf889cc4d0e028f2c7 · Note