CVE-2022-49957
MEDIUMLinux Kernel 4.9.84-4.10 - Use of Uninitialized Resource in KCM strp_init
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.
References (7)
Core 7
Core References
Scores
CVSS v3
5.5
EPSS
0.0022
EPSS Percentile
12.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-908
Status
published
Products (25)
Linux/Linux
< 4.15
Linux/Linux
085cbbda4b4cc7dd2ba63806346881c2c2e10107
Linux/Linux
19042316b9e12c93bf334a04d4dd7a4e846c7311
Linux/Linux
383250363daf01eb7aa3728c09ef8a4f6d8a3252
Linux/Linux
4.14.22 - 4.14.293
Linux/Linux
4.14.293 - 4.14.*
Linux/Linux
4.15
Linux/Linux
4.19.258 - 4.19.*
Linux/Linux
4.9.100 - 4.10
Linux/Linux
4.9.84 - 4.10
... and 15 more
Published
Jun 18, 2025
Tracked Since
Feb 18, 2026