GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49087 (GCVE-0-2022-49087)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:53
VLAI
Title
rxrpc: fix a race in rxrpc_exit_net()
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix a race in rxrpc_exit_net() Current code can lead to the following race: CPU0 CPU1 rxrpc_exit_net() rxrpc_peer_keepalive_worker() if (rxnet->live) rxnet->live = false; del_timer_sync(&rxnet->peer_keepalive_timer); timer_reduce(&rxnet->peer_keepalive_timer, jiffies + delay); cancel_work_sync(&rxnet->peer_keepalive_work); rxrpc_exit_net() exits while peer_keepalive_timer is still armed, leading to use-after-free. syzbot report was: ODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0 WARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Modules linked in: CPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 <0f> 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc9000353fb00 EFLAGS: 00010082 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0 R13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __debug_check_no_obj_freed lib/debugobjects.c:992 [inline] debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023 kfree+0xd6/0x310 mm/slab.c:3809 ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176 ops_free_list net/core/net_namespace.c:174 [inline] cleanup_net+0x591/0xb00 net/core/net_namespace.c:598 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:17 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 864297ee30727ae6233f80296b7fc91442620b05 (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 7ee84d29f22de6f6c63fad6c54690517659862f1 (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 08ff0e74fab517dbc44e11b8bc683dd4ecc65950 (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 571d8e1d154ca18f08dcb72b69318d36e10010a0 (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 41024a40f6c793abbb916a857f18fb009f07464c (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < cd8aef1f30d1215648e4e6686cfb422004851429 (git)
Affected: ace45bec6d77bc061c3c3d8ad99e298ea9800c2b , < 1946014ca3b19be9e485e780e862c375c6f98bad (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.111 , ≤ 5.10.* (semver)
Unaffected: 5.15.34 , ≤ 5.15.* (semver)
Unaffected: 5.16.20 , ≤ 5.16.* (semver)
Unaffected: 5.17.3 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:17:30.562104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:35.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/net_ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "864297ee30727ae6233f80296b7fc91442620b05",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "7ee84d29f22de6f6c63fad6c54690517659862f1",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "08ff0e74fab517dbc44e11b8bc683dd4ecc65950",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "571d8e1d154ca18f08dcb72b69318d36e10010a0",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "41024a40f6c793abbb916a857f18fb009f07464c",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "cd8aef1f30d1215648e4e6686cfb422004851429",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            },
            {
              "lessThan": "1946014ca3b19be9e485e780e862c375c6f98bad",
              "status": "affected",
              "version": "ace45bec6d77bc061c3c3d8ad99e298ea9800c2b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/net_ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.111",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix a race in rxrpc_exit_net()\n\nCurrent code can lead to the following race:\n\nCPU0                                                 CPU1\n\nrxrpc_exit_net()\n                                                     rxrpc_peer_keepalive_worker()\n                                                       if (rxnet-\u003elive)\n\n  rxnet-\u003elive = false;\n  del_timer_sync(\u0026rxnet-\u003epeer_keepalive_timer);\n\n                                                             timer_reduce(\u0026rxnet-\u003epeer_keepalive_timer, jiffies + delay);\n\n  cancel_work_sync(\u0026rxnet-\u003epeer_keepalive_work);\n\nrxrpc_exit_net() exits while peer_keepalive_timer is still armed,\nleading to use-after-free.\n\nsyzbot report was:\n\nODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0\nWARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505\nModules linked in:\nCPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: netns cleanup_net\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505\nCode: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 \u003c0f\u003e 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3\nRSP: 0018:ffffc9000353fb00 EFLAGS: 00010082\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000\nRDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0\nR13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000\nFS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __debug_check_no_obj_freed lib/debugobjects.c:992 [inline]\n debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023\n kfree+0xd6/0x310 mm/slab.c:3809\n ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176\n ops_free_list net/core/net_namespace.c:174 [inline]\n cleanup_net+0x591/0xb00 net/core/net_namespace.c:598\n process_one_work+0x996/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e9/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298\n \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered only during rxrpc_exit_net() on network-namespace teardown after a local AF_RXRPC socket arms the keepalive timer; remote RxRPC/AFS packets do not invoke this exit path.\nAC:L - The attacker controls both sides of the race by creating an AF_RXRPC socket (which starts the keepalive timer/worker) and destroying their own netns to run rxrpc_exit_net(), and can retry until the TOCTOU window is hit.\nPR:L - An unprivileged user can unshare a user+net namespace (CAP_SYS_ADMIN in their userns) and open AF_RXRPC sockets with no capability checks in rxrpc_create(), which is sufficient to arm the timer and trigger cleanup.\nUI:N - No victim action is required; the attacker alone creates the socket and tears down the netns to hit the race.\nS:U - This is a standard in-kernel UAF enabling local privilege escalation within the same kernel authority, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Use-after-free of the timer embedded in freed rxrpc_net/net_generic memory can be reclaimed and leveraged for arbitrary kernel memory disclosure primitives.\nI:H - A pending timer UAF is a classic control-flow hijack primitive (timer callback on reclaimed memory), enabling arbitrary write/code execution in the kernel.\nA:H - The race frees an armed timer_list (syzbot: ODEBUG free active timer), causing kernel warnings/oops or a crash when the stale timer later fires."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:49.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/864297ee30727ae6233f80296b7fc91442620b05"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ee84d29f22de6f6c63fad6c54690517659862f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ff0e74fab517dbc44e11b8bc683dd4ecc65950"
        },
        {
          "url": "https://git.kernel.org/stable/c/571d8e1d154ca18f08dcb72b69318d36e10010a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/41024a40f6c793abbb916a857f18fb009f07464c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd8aef1f30d1215648e4e6686cfb422004851429"
        },
        {
          "url": "https://git.kernel.org/stable/c/1946014ca3b19be9e485e780e862c375c6f98bad"
        }
      ],
      "title": "rxrpc: fix a race in rxrpc_exit_net()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49087",
    "datePublished": "2025-02-26T01:54:44.557Z",
    "dateReserved": "2025-02-26T01:49:39.248Z",
    "dateUpdated": "2026-08-05T08:53:49.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49087",
      "date": "2026-09-17",
      "epss": "0.00248",
      "percentile": "0.1637"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49087\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:46.043\",\"lastModified\":\"2026-06-17T05:17:02.637\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: fix a race in rxrpc_exit_net()\\n\\nCurrent code can lead to the following race:\\n\\nCPU0                                                 CPU1\\n\\nrxrpc_exit_net()\\n                                                     rxrpc_peer_keepalive_worker()\\n                                                       if (rxnet-\u003elive)\\n\\n  rxnet-\u003elive = false;\\n  del_timer_sync(\u0026rxnet-\u003epeer_keepalive_timer);\\n\\n                                                             timer_reduce(\u0026rxnet-\u003epeer_keepalive_timer, jiffies + delay);\\n\\n  cancel_work_sync(\u0026rxnet-\u003epeer_keepalive_work);\\n\\nrxrpc_exit_net() exits while peer_keepalive_timer is still armed,\\nleading to use-after-free.\\n\\nsyzbot report was:\\n\\nODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0\\nWARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505\\nModules linked in:\\nCPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\nWorkqueue: netns cleanup_net\\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505\\nCode: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 \u003c0f\u003e 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3\\nRSP: 0018:ffffc9000353fb00 EFLAGS: 00010082\\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000\\nRDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52\\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\\nR10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0\\nR13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000\\nFS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n __debug_check_no_obj_freed lib/debugobjects.c:992 [inline]\\n debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023\\n kfree+0xd6/0x310 mm/slab.c:3809\\n ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176\\n ops_free_list net/core/net_namespace.c:174 [inline]\\n cleanup_net+0x591/0xb00 net/core/net_namespace.c:598\\n process_one_work+0x996/0x1610 kernel/workqueue.c:2289\\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\\n kthread+0x2e9/0x3a0 kernel/kthread.c:376\\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298\\n \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: se corrige una ejecuci\u00f3n en rxrpc_exit_net() El c\u00f3digo actual puede llevar a la siguiente ejecuci\u00f3n: CPU0 CPU1 rxrpc_exit_net() rxrpc_peer_keepalive_worker() if (rxnet-\u0026gt;live) rxnet-\u0026gt;live = false; del_timer_sync(\u0026amp;rxnet-\u0026gt;peer_keepalive_timer); timer_reduce(\u0026amp;rxnet-\u0026gt;peer_keepalive_timer, jiffies + delay); cancel_work_sync(\u0026amp;rxnet-\u0026gt;peer_keepalive_work); rxrpc_exit_net() sale mientras peer_keepalive_timer todav\u00eda est\u00e1 armado, lo que lleva a un use-after-free. El informe de syzbot fue: ODEBUG: activo libre (estado activo 0) tipo de objeto: timer_list sugerencia: rxrpc_peer_keepalive_timeout+0x0/0xb0 ADVERTENCIA: CPU: 0 PID: 3660 en lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 M\u00f3dulos vinculados en: CPU: 0 PID: 3660 Comm: kworker/u4:6 No contaminado 5.17.0-syzkaller-13993-g88e6c0207623 #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Cola de trabajo: netns cleanup_net RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 C\u00f3digo: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 \u0026lt;0f\u0026gt; 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc9000353fb00 EFLAGS: 00010082 RAX: 0000000000000000 RBX: 00000000000000003 RCX: 0000000000000000 RDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0 R13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  __debug_check_no_obj_freed lib/debugobjects.c:992 [en l\u00ednea] debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023 kfree+0xd6/0x310 mm/slab.c:3809 ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176 ops_free_list net/core/net_namespace.c:174 [en l\u00ednea] cleanup_net+0x591/0xb00 net/core/net_namespace.c:598 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/rxrpc/net_ns.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"864297ee30727ae6233f80296b7fc91442620b05\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"7ee84d29f22de6f6c63fad6c54690517659862f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"08ff0e74fab517dbc44e11b8bc683dd4ecc65950\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"571d8e1d154ca18f08dcb72b69318d36e10010a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"41024a40f6c793abbb916a857f18fb009f07464c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"cd8aef1f30d1215648e4e6686cfb422004851429\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\",\"lessThan\":\"1946014ca3b19be9e485e780e862c375c6f98bad\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/rxrpc/net_ns.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.238\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.189\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.111\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.34\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.20\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.3\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:17:30.562104Z\",\"id\":\"CVE-2022-49087\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"4.19.238\",\"matchCriteriaId\":\"E81609D6-22A9-44E6-A18A-6CEE1B7F0445\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.189\",\"matchCriteriaId\":\"8CB6E8F5-C2B1-46F3-A807-0F6104AC340F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.111\",\"matchCriteriaId\":\"96258501-7BCE-4C55-8A38-8AC9D327626D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.34\",\"matchCriteriaId\":\"D25878D3-7761-4E9F-8919-E92CD53896E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.20\",\"matchCriteriaId\":\"ABBBA66E-0244-4621-966B-9790AF1EEB00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.3\",\"matchCriteriaId\":\"AE420AC7-1E59-4398-B84F-71F4B4337762\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08ff0e74fab517dbc44e11b8bc683dd4ecc65950\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1946014ca3b19be9e485e780e862c375c6f98bad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41024a40f6c793abbb916a857f18fb009f07464c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/571d8e1d154ca18f08dcb72b69318d36e10010a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ee84d29f22de6f6c63fad6c54690517659862f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/864297ee30727ae6233f80296b7fc91442620b05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd8aef1f30d1215648e4e6686cfb422004851429\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T20:57:30+00:00",
      "cve": "CVE-2022-49087",
      "id": "CVE-2022-49087",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: fix a race in rxrpc_exit_net()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49087.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49087\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:17:30.562104Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:17:31.839Z\"}}], \"cna\": {\"title\": \"rxrpc: fix a race in rxrpc_exit_net()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is triggered only during rxrpc_exit_net() on network-namespace teardown after a local AF_RXRPC socket arms the keepalive timer; remote RxRPC/AFS packets do not invoke this exit path.\\nAC:L - The attacker controls both sides of the race by creating an AF_RXRPC socket (which starts the keepalive timer/worker) and destroying their own netns to run rxrpc_exit_net(), and can retry until the TOCTOU window is hit.\\nPR:L - An unprivileged user can unshare a user+net namespace (CAP_SYS_ADMIN in their userns) and open AF_RXRPC sockets with no capability checks in rxrpc_create(), which is sufficient to arm the timer and trigger cleanup.\\nUI:N - No victim action is required; the attacker alone creates the socket and tears down the netns to hit the race.\\nS:U - This is a standard in-kernel UAF enabling local privilege escalation within the same kernel authority, not a VM/IOMMU/sandbox boundary crossing.\\nC:H - Use-after-free of the timer embedded in freed rxrpc_net/net_generic memory can be reclaimed and leveraged for arbitrary kernel memory disclosure primitives.\\nI:H - A pending timer UAF is a classic control-flow hijack primitive (timer callback on reclaimed memory), enabling arbitrary write/code execution in the kernel.\\nA:H - The race frees an armed timer_list (syzbot: ODEBUG free active timer), causing kernel warnings/oops or a crash when the stale timer later fires.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"864297ee30727ae6233f80296b7fc91442620b05\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"7ee84d29f22de6f6c63fad6c54690517659862f1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"08ff0e74fab517dbc44e11b8bc683dd4ecc65950\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"571d8e1d154ca18f08dcb72b69318d36e10010a0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"41024a40f6c793abbb916a857f18fb009f07464c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"cd8aef1f30d1215648e4e6686cfb422004851429\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ace45bec6d77bc061c3c3d8ad99e298ea9800c2b\", \"lessThan\": \"1946014ca3b19be9e485e780e862c375c6f98bad\", \"versionType\": \"git\"}], \"programFiles\": [\"net/rxrpc/net_ns.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.238\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.189\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.111\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.20\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/rxrpc/net_ns.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/864297ee30727ae6233f80296b7fc91442620b05\"}, {\"url\": \"https://git.kernel.org/stable/c/7ee84d29f22de6f6c63fad6c54690517659862f1\"}, {\"url\": \"https://git.kernel.org/stable/c/08ff0e74fab517dbc44e11b8bc683dd4ecc65950\"}, {\"url\": \"https://git.kernel.org/stable/c/571d8e1d154ca18f08dcb72b69318d36e10010a0\"}, {\"url\": \"https://git.kernel.org/stable/c/41024a40f6c793abbb916a857f18fb009f07464c\"}, {\"url\": \"https://git.kernel.org/stable/c/cd8aef1f30d1215648e4e6686cfb422004851429\"}, {\"url\": \"https://git.kernel.org/stable/c/1946014ca3b19be9e485e780e862c375c6f98bad\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: fix a race in rxrpc_exit_net()\\n\\nCurrent code can lead to the following race:\\n\\nCPU0                                                 CPU1\\n\\nrxrpc_exit_net()\\n                                                     rxrpc_peer_keepalive_worker()\\n                                                       if (rxnet-\u003elive)\\n\\n  rxnet-\u003elive = false;\\n  del_timer_sync(\u0026rxnet-\u003epeer_keepalive_timer);\\n\\n                                                             timer_reduce(\u0026rxnet-\u003epeer_keepalive_timer, jiffies + delay);\\n\\n  cancel_work_sync(\u0026rxnet-\u003epeer_keepalive_work);\\n\\nrxrpc_exit_net() exits while peer_keepalive_timer is still armed,\\nleading to use-after-free.\\n\\nsyzbot report was:\\n\\nODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0\\nWARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505\\nModules linked in:\\nCPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\\nWorkqueue: netns cleanup_net\\nRIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505\\nCode: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 \u003c0f\u003e 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3\\nRSP: 0018:ffffc9000353fb00 EFLAGS: 00010082\\nRAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000\\nRDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52\\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\\nR10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0\\nR13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000\\nFS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n __debug_check_no_obj_freed lib/debugobjects.c:992 [inline]\\n debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023\\n kfree+0xd6/0x310 mm/slab.c:3809\\n ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176\\n ops_free_list net/core/net_namespace.c:174 [inline]\\n cleanup_net+0x591/0xb00 net/core/net_namespace.c:598\\n process_one_work+0x996/0x1610 kernel/workqueue.c:2289\\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\\n kthread+0x2e9/0x3a0 kernel/kthread.c:376\\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298\\n \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.238\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.189\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.111\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.34\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.20\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.3\", \"versionStartIncluding\": \"4.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"4.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:53:49.787Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49087\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:53:49.787Z\", \"dateReserved\": \"2025-02-26T01:49:39.248Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:44.557Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.