PT-2025-8704 · Linux+4 · Linux Kernel+4

Jakub Kicinski + 2 · Published 2022-06-23 · Updated 2025-10-24 · CVE-2022-49732

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue is related to the protection check for psock vs ULP. The inet csk has ulp(sk) check was moved from sk psock init() to the new tcp bpf update proto() function, potentially allowing the creation of psocks for non-inet sockets. However, the destruction path for psock includes the ULP unwind, requiring the sk psock init() to fail if ULP is already present. Otherwise, it may result in the ULP looping its callbacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-03874

CESA-2023_2951

CVE-2022-49732

RHSA-2022:8267

RHSA-2022_8267

RHSA-2023:2951

RHSA-2023_2951

SUSE-SU-2025:1176-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1306

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49732.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-49732 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49732 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49732 · Vendor Advisory
• https://git.kernel.org/stable/c/922309e50befb0cfa5cb65e4989b7706d6578846 · Patch
• https://git.kernel.org/stable/c/72fa0f65b56605b8a9ae9fba2082f2123f7fe017 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49732 · Security Note
• https://bdu.fstec.ru/vul/2026-03874 · Security Note
• https://ubuntu.com/security/CVE-2022-49732 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49732 · Vendor Advisory
• https://git.kernel.org/stable/c/e34a07c0ae3906f97eb18df50902e2a01c1015b6 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49732 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-49579 · Note