CVE-2022-49957
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedJun 18, 2025
First seenJun 18, 2025
How to fix
Update
- linux linux_kernel4.10, 4.14.293, 4.15, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.9.84 ≤ v < 4.10, 4.9.100 ≤ v < 4.10, 4.14.22 ≤ v < 4.14.293, 4.14.41 ≤ v < 4.15, 4.15.1 ≤ v < 4.19.258, 4.20 ≤ v < 5.4.213, 5.5 ≤ v < 5.10.142, 5.11 ≤ v < 5.15.66, 5.16 ≤ v < 5.19.8, 4.15, 6.0 | 4.10, 4.14.293, 4.15, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.