CVE-2022-49587

tcp: Fix a data-race around sysctl_tcp_notsent_lowat.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix a data-race around sysctl_tcp_notsent_lowat.

While reading sysctl_tcp_notsent_lowat, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 91e21df688f8a75255ca9c459da39ac96300113aAffected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before c1b85c5a34294f7444c13bf828e0e84b0a0eed85Affected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 0f75343584ee474303e17efe0610bdd170af1d13Affected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before e9362a993886613ef0284c2a4911c6017c97d803Affected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before fd6f1284e380c377932186042ff0b5c987fb2b92Affected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 80d4d0c461674eea87f0977e12a2ecd334b9b79cAffected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 62e56cfeb2ae4b53ae9ca24c80f54093250ce64aAffected c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 55be873695ed8912eb77ff46d1d1cadf028bd0f3Affected
LinuxLinux	3.12Affected before 3.12Not affected 4.9.325 through 4.9.Not affected 4.14.290 through 4.14.Not affected 4.19.254 through 4.19.Not affected 5.4.208 through 5.4.Not affected 5.10.134 through 5.10.Not affected 5.15.58 through 5.15.Not affected 5.18.15 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 91e21df688f8a75255ca9c459da39ac96300113aAffected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before c1b85c5a34294f7444c13bf828e0e84b0a0eed85Affected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 0f75343584ee474303e17efe0610bdd170af1d13Affected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before e9362a993886613ef0284c2a4911c6017c97d803Affected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before fd6f1284e380c377932186042ff0b5c987fb2b92Affected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 80d4d0c461674eea87f0977e12a2ecd334b9b79cAffected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 62e56cfeb2ae4b53ae9ca24c80f54093250ce64aAffected
c9bee3b7fdecb0c1d070c7b54113b3bdfb9a3d36 to before 55be873695ed8912eb77ff46d1d1cadf028bd0f3Affected

LinuxLinux

3.12Affected
before 3.12Not affected
4.9.325 through 4.9.*Not affected
4.14.290 through 4.14.*Not affected
4.19.254 through 4.19.*Not affected
5.4.208 through 5.4.*Not affected
5.10.134 through 5.10.*Not affected
5.15.58 through 5.15.*Not affected
5.18.15 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.