Riskcovery

CVE-2022-49580

ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.

State
Published
Severity
4.7 Medium
Published
Feb 26, 2025
Updated
May 11, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.

While reading sysctl_fib_multipath_use_neigh, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
LinuxLinux
  • a6db4494d218c2e559173661ee972e048dc04fdd to before 6727f39e99e0f545d815edebb6c94228485427ecAffected
  • a6db4494d218c2e559173661ee972e048dc04fdd to before e045d672ba06e1d35bacb56374d350de0ac99066Affected
  • a6db4494d218c2e559173661ee972e048dc04fdd to before b8d345db03b4deffb4f04219a51d3b1e94171b76Affected
  • a6db4494d218c2e559173661ee972e048dc04fdd to before 14e996577ed2799a1ed6ffeb71c76d63acb28444Affected
  • a6db4494d218c2e559173661ee972e048dc04fdd to before 87507bcb4f5de16bb419e9509d874f4db6c0ad0fAffected
LinuxLinux
  • 4.7Affected
  • before 4.7Not affected
  • 5.4.208 through 5.4.*Not affected
  • 5.10.134 through 5.10.*Not affected
  • 5.15.58 through 5.15.*Not affected
  • 5.18.15 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.