CVE-2022-49957

MEDIUM

Linux Kernel 4.9.84-4.10 - Use of Uninitialized Resource in KCM strp_init

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: kcm: fix strp_init() order and cleanup strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away.

Scores

CVSS v3 5.5
EPSS 0.0022
EPSS Percentile 12.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-908
Status published
Products (30)
linux/Kernel < 4.14.293linux
linux/Kernel 4.15.0 - 5.4.213linux
linux/Kernel 4.20.0 - 5.10.142linux
linux/Kernel 5.11.0 - 5.19.8linux
linux/Kernel 5.5.0 - 5.15.66linux
Linux/Linux < 4.15
Linux/Linux 085cbbda4b4cc7dd2ba63806346881c2c2e10107
Linux/Linux 19042316b9e12c93bf334a04d4dd7a4e846c7311
Linux/Linux 383250363daf01eb7aa3728c09ef8a4f6d8a3252
Linux/Linux 4.14.22 - 4.14.293
... and 20 more
Published Jun 18, 2025
Tracked Since Feb 18, 2026