CVE-2022-49957
MEDIUMLinux Kernel 4.9.84-4.10 - Use of Uninitialized Resource in KCM strp_init
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.
References (7)
Core 7
Core References
Scores
CVSS v3
5.5
EPSS
0.0022
EPSS Percentile
12.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-908
Status
published
Products (30)
linux/Kernel
< 4.14.293linux
linux/Kernel
4.15.0 - 5.4.213linux
linux/Kernel
4.20.0 - 5.10.142linux
linux/Kernel
5.11.0 - 5.19.8linux
linux/Kernel
5.5.0 - 5.15.66linux
Linux/Linux
< 4.15
Linux/Linux
085cbbda4b4cc7dd2ba63806346881c2c2e10107
Linux/Linux
19042316b9e12c93bf334a04d4dd7a4e846c7311
Linux/Linux
383250363daf01eb7aa3728c09ef8a4f6d8a3252
Linux/Linux
4.14.22 - 4.14.293
... and 20 more
Published
Jun 18, 2025
Tracked Since
Feb 18, 2026