CVE-2022-49957

MEDIUM

Linux Kernel 4.9.84-4.10 - Use of Uninitialized Resource in KCM strp_init

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.

Scores

CVSS v3 5.5
EPSS 0.0022
EPSS Percentile 12.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-908
Status published
Products (25)
Linux/Linux < 4.15
Linux/Linux 085cbbda4b4cc7dd2ba63806346881c2c2e10107
Linux/Linux 19042316b9e12c93bf334a04d4dd7a4e846c7311
Linux/Linux 383250363daf01eb7aa3728c09ef8a4f6d8a3252
Linux/Linux 4.14.22 - 4.14.293
Linux/Linux 4.14.293 - 4.14.*
Linux/Linux 4.15
Linux/Linux 4.19.258 - 4.19.*
Linux/Linux 4.9.100 - 4.10
Linux/Linux 4.9.84 - 4.10
... and 15 more
Published Jun 18, 2025
Tracked Since Feb 18, 2026