PT-2025-8595 · Linux+1 · Linux Kernel+1

Syzbot · Published 2022-06-29 · Updated 2025-02-27 · CVE-2022-49662

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-rc2-syzkaller

Description A vulnerability has been resolved in the Linux kernel. The issue is related to the use of rcu dereference() when rcu read lock() is not held, as reported by syzbot. This can cause a lockdep splat in in6 dump addrs(). The problem occurs in the net/ipv6/addrconf.c file.

Recommendations For Linux kernel versions prior to 5.19.0-rc2-syzkaller, update to a version that includes the fix for the in6 dump addrs() function to prevent the lockdep splat. As a temporary workaround, consider restricting the use of the rcu dereference() function when rcu read lock() is not held to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-04001

CVE-2022-49662

Affected Products

Astra Linux

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49662.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49662 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04001 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49662 · Security Note
• https://ubuntu.com/security/CVE-2022-49662 · Vendor Advisory
• https://git.kernel.org/stable/c/b39fda51c32dd879451e0119881f31493bf83283 · Patch
• https://git.kernel.org/stable/c/2930ee1a166df0e12fe9fec4b79cc3dc9634ae45 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49662 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49662 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49662 · Vendor Advisory
• https://git.kernel.org/stable/c/4e43e64d0f1332fcc503babad4dc31aead7131ca · Patch
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.10 · Note
• https://access.redhat.com/security/cve/cve-2022-49662 · Note
• https://git.kernel.org/linus/4e43e64d0f1332fcc503babad4dc31aead7131ca · Note