Riskcovery

CVE-2022-49577

udp: Fix a data-race around sysctl_udp_l3mdev_accept.

State
Published
Severity
4.7 Medium
Published
Feb 26, 2025
Updated
May 11, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

udp: Fix a data-race around sysctl_udp_l3mdev_accept.

While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
LinuxLinux
  • 63a6fff353d01da5a22b72670c434bf12fa0e3b8 to before f39b03bd727a8fea62e82f10fe2e0d753b9930ffAffected
  • 63a6fff353d01da5a22b72670c434bf12fa0e3b8 to before fcaef69c79ec222e55643e666b80b221e70fa6a8Affected
  • 63a6fff353d01da5a22b72670c434bf12fa0e3b8 to before 3f2ac2d6511bb0652abf4d7388d65bb9ff1c641cAffected
  • 63a6fff353d01da5a22b72670c434bf12fa0e3b8 to before cb0d28934ca10f99c47e2c6f451405d6c954fe48Affected
  • 63a6fff353d01da5a22b72670c434bf12fa0e3b8 to before 3d72bb4188c708bb16758c60822fc4dda7a95174Affected
LinuxLinux
  • 4.11Affected
  • before 4.11Not affected
  • 5.4.208 through 5.4.*Not affected
  • 5.10.134 through 5.10.*Not affected
  • 5.15.58 through 5.15.*Not affected
  • 5.18.15 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.