GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49814 (GCVE-0-2022-49814)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:09 – Updated: 2026-08-05 08:56
VLAI
Title
kcm: close race conditions on sk_receive_queue
Summary
In the Linux kernel, the following vulnerability has been resolved: kcm: close race conditions on sk_receive_queue sk->sk_receive_queue is protected by skb queue lock, but for KCM sockets its RX path takes mux->rx_lock to protect more than just skb queue. However, kcm_recvmsg() still only grabs the skb queue lock, so race conditions still exist. We can teach kcm_recvmsg() to grab mux->rx_lock too but this would introduce a potential performance regression as struct kcm_mux can be shared by multiple KCM sockets. So we have to enforce skb queue lock in requeue_rx_msgs() and handle skb peek case carefully in kcm_wait_data(). Fortunately, skb_recv_datagram() already handles it nicely and is widely used by other sockets, we can just switch to skb_recv_datagram() after getting rid of the unnecessary sock lock in kcm_recvmsg() and kcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets, so it is safe to get rid of this check too. I ran the original syzbot reproducer for 30 min without seeing any issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 22f6b5d47396b4287662668ee3f5c1f766cb4259 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < d9ad4de92e184b19bcae4da10dac0275abf83931 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < ce57d6474ae999a3b2d442314087473a646a65c7 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 4154b6afa2bd639214ff259d912faad984f7413a (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < bf92e54597d842da127c59833b365d6faeeaf020 (git)
Affected: ab7ac4eb9832e32a09f4e8042705484d2fb0aad3 , < 5121197ecc5db58c07da95eb1ff82b98b121a221 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 4.14.300 , ≤ 4.14.* (semver)
Unaffected: 4.19.267 , ≤ 4.19.* (semver)
Unaffected: 5.4.225 , ≤ 5.4.* (semver)
Unaffected: 5.10.156 , ≤ 5.10.* (semver)
Unaffected: 5.15.80 , ≤ 5.15.* (semver)
Unaffected: 6.0.10 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22f6b5d47396b4287662668ee3f5c1f766cb4259",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "d9ad4de92e184b19bcae4da10dac0275abf83931",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "ce57d6474ae999a3b2d442314087473a646a65c7",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "4154b6afa2bd639214ff259d912faad984f7413a",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "bf92e54597d842da127c59833b365d6faeeaf020",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            },
            {
              "lessThan": "5121197ecc5db58c07da95eb1ff82b98b121a221",
              "status": "affected",
              "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/kcm/kcmsock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.300",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.267",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.225",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.156",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.80",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.10",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: close race conditions on sk_receive_queue\n\nsk-\u003esk_receive_queue is protected by skb queue lock, but for KCM\nsockets its RX path takes mux-\u003erx_lock to protect more than just\nskb queue. However, kcm_recvmsg() still only grabs the skb queue\nlock, so race conditions still exist.\n\nWe can teach kcm_recvmsg() to grab mux-\u003erx_lock too but this would\nintroduce a potential performance regression as struct kcm_mux can\nbe shared by multiple KCM sockets.\n\nSo we have to enforce skb queue lock in requeue_rx_msgs() and handle\nskb peek case carefully in kcm_wait_data(). Fortunately,\nskb_recv_datagram() already handles it nicely and is widely used by\nother sockets, we can just switch to skb_recv_datagram() after\ngetting rid of the unnecessary sock lock in kcm_recvmsg() and\nkcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets,\nso it is safe to get rid of this check too.\n\nI ran the original syzbot reproducer for 30 min without seeing any\nissue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is triggered only via local AF_KCM syscalls (socket, SIOCKCMATTACH/CLONE, setsockopt KCM_RECV_DISABLE/close, and recvmsg/recvmmsg); remote TCP data may fill the queue but cannot alone exercise the unlocked requeue versus recvmsg window.\nAC:L - The attacker controls both sides of the race\u2014one thread in kcm_recvmsg while another drives requeue_rx_msgs via KCM_RECV_DISABLE, close/kcm_done, or mux RX paths on sockets they created\u2014and can retry indefinitely; syzbot reproduced a GPF in skb_unlink with a C repro.\nPR:L - net/kcm/ has no capable()/CAP_NET_ADMIN checks; AF_KCM autoloads via MODULE_ALIAS_NETPROTO(PF_KCM), and an unprivileged user can create KCM sockets, attach their own TCP socket with a SOCKET_FILTER, and trigger the race (same PR:L posture as CVE-2025-38717).\nUI:N - The attacker performs socket setup, attach/clone, concurrent recvmsg and disable/close entirely themselves; no victim action is required.\nS:U - This is a standard in-kernel sk_buff heap use-after-free within the host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The race leaves recvmsg holding a pointer to an sk_buff already dequeued/freed by requeue_rx_msgs, a reclaimable heap UAF that enables arbitrary kernel read via spray/reuse of the freed skb.\nI:H - Concurrent unlocked unlink/dequeue corrupts the receive-queue list and can double-free the skb, giving a heap write/control-flow primitive consistent with treating exploitable kernel UAFs as High integrity.\nA:H - Even without full exploitation, the bug causes a general protection fault/oops in skb_unlink from kcm_recvmsg (as demonstrated by syzbot), which is a full kernel availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:23.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22f6b5d47396b4287662668ee3f5c1f766cb4259"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9ad4de92e184b19bcae4da10dac0275abf83931"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce57d6474ae999a3b2d442314087473a646a65c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4154b6afa2bd639214ff259d912faad984f7413a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf92e54597d842da127c59833b365d6faeeaf020"
        },
        {
          "url": "https://git.kernel.org/stable/c/5121197ecc5db58c07da95eb1ff82b98b121a221"
        }
      ],
      "title": "kcm: close race conditions on sk_receive_queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49814",
    "datePublished": "2025-05-01T14:09:38.389Z",
    "dateReserved": "2025-05-01T14:05:17.226Z",
    "dateUpdated": "2026-08-05T08:56:23.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49814",
      "date": "2026-09-18",
      "epss": "0.00161",
      "percentile": "0.05762"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/kcm/kcmsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "22f6b5d47396b4287662668ee3f5c1f766cb4259",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9ad4de92e184b19bcae4da10dac0275abf83931",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce57d6474ae999a3b2d442314087473a646a65c7",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4154b6afa2bd639214ff259d912faad984f7413a",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf92e54597d842da127c59833b365d6faeeaf020",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5121197ecc5db58c07da95eb1ff82b98b121a221",
                    "status": "affected",
                    "version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/kcm/kcmsock.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.300",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.267",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.225",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28F9FB24-45B7-427D-8BB8-C4F91A2CA203",
                    "versionEndExcluding": "4.14.300",
                    "versionStartIncluding": "4.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5C69A12-68E2-400E-9A5A-375A673C8402",
                    "versionEndExcluding": "4.19.267",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "94D21814-3051-4860-AB06-C7880A3D4933",
                    "versionEndExcluding": "5.4.225",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2152F3D-E6D3-405D-B0BE-911B8B6E2EE6",
                    "versionEndExcluding": "5.10.156",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "51BBEF3B-79F5-4D4C-ADBA-F34DA0E2465C",
                    "versionEndExcluding": "5.15.80",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "64F9ADD1-3ADB-4D66-A00F-4A83010B05F0",
                    "versionEndExcluding": "6.0.10",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: close race conditions on sk_receive_queue\n\nsk-\u003esk_receive_queue is protected by skb queue lock, but for KCM\nsockets its RX path takes mux-\u003erx_lock to protect more than just\nskb queue. However, kcm_recvmsg() still only grabs the skb queue\nlock, so race conditions still exist.\n\nWe can teach kcm_recvmsg() to grab mux-\u003erx_lock too but this would\nintroduce a potential performance regression as struct kcm_mux can\nbe shared by multiple KCM sockets.\n\nSo we have to enforce skb queue lock in requeue_rx_msgs() and handle\nskb peek case carefully in kcm_wait_data(). Fortunately,\nskb_recv_datagram() already handles it nicely and is widely used by\nother sockets, we can just switch to skb_recv_datagram() after\ngetting rid of the unnecessary sock lock in kcm_recvmsg() and\nkcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets,\nso it is safe to get rid of this check too.\n\nI ran the original syzbot reproducer for 30 min without seeing any\nissue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kcm: condiciones de ejecuci\u00f3n cerradas en sk_receive_queue. sk-\u0026gt;sk_receive_queue est\u00e1 protegido por el bloqueo de cola skb, pero para los sockets KCM su ruta RX toma mux-\u0026gt;rx_lock para proteger m\u00e1s que solo la cola skb. Sin embargo, kcm_recvmsg() todav\u00eda solo captura el bloqueo de cola skb, por lo que las condiciones de ejecuci\u00f3n a\u00fan existen. Podemos ense\u00f1ar a kcm_recvmsg() a capturar tambi\u00e9n mux-\u0026gt;rx_lock, pero esto introducir\u00eda una posible regresi\u00f3n del rendimiento, ya que la estructura kcm_mux puede ser compartida por varios sockets KCM. Por lo tanto, debemos aplicar el bloqueo de cola skb en requeue_rx_msgs() y manejar el caso de skb peek con cuidado en kcm_wait_data(). Afortunadamente, skb_recv_datagram() ya lo gestiona correctamente y es ampliamente utilizado por otros sockets. Podemos cambiar a skb_recv_datagram() tras eliminar el bloqueo de sock innecesario en kcm_recvmsg() y kcm_splice_read(). Nota: Los sockets KCM no utilizan SOCK_DONE, por lo que tambi\u00e9n es seguro omitir esta comprobaci\u00f3n. Ejecut\u00e9 el reproductor syzbot original durante 30 minutos sin observar ning\u00fan problema."
          }
        ],
        "id": "CVE-2022-49814",
        "lastModified": "2026-08-04T10:17:56.803",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-01T15:16:04.787",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/22f6b5d47396b4287662668ee3f5c1f766cb4259"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4154b6afa2bd639214ff259d912faad984f7413a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5121197ecc5db58c07da95eb1ff82b98b121a221"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bf92e54597d842da127c59833b365d6faeeaf020"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ce57d6474ae999a3b2d442314087473a646a65c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d9ad4de92e184b19bcae4da10dac0275abf83931"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:18:34+00:00",
      "cve": "CVE-2022-49814",
      "id": "CVE-2022-49814",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kcm: close race conditions on sk_receive_queue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49814.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.