CVE-2022-49590

igmp: Fix data-races around sysctl_igmp_llm_reports.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

igmp: Fix data-races around sysctl_igmp_llm_reports.

While reading sysctl_igmp_llm_reports, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers.

This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next.

if (ipv4_is_local_multicast(pmc->multiaddr) && !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before a84b4afaca2573ed3aed1f8854aefe3ca5a82e72Affected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before d77969e7d4ccc26bf1f414a39ef35050a83ba6d5Affected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before ed876e99ccf417b8bd7fd8408ba5e8b008e46cc8Affected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 1656ecaddf90e2a070ec2d2404cdae3edf80facaAffected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 473aad9ad57ff760005377e6f45a2ad4210e08ceAffected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 260446eb8e5541402b271343a4516f2b33dec1e4Affected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 46307adceb67bdf2ec38408dd9cebc378a6b5c46Affected df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before f6da2267e71106474fbc0943dc24928b9cb79119Affected
LinuxLinux	4.3Affected before 4.3Not affected 4.9.325 through 4.9.Not affected 4.14.290 through 4.14.Not affected 4.19.254 through 4.19.Not affected 5.4.208 through 5.4.Not affected 5.10.134 through 5.10.Not affected 5.15.58 through 5.15.Not affected 5.18.15 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before a84b4afaca2573ed3aed1f8854aefe3ca5a82e72Affected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before d77969e7d4ccc26bf1f414a39ef35050a83ba6d5Affected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before ed876e99ccf417b8bd7fd8408ba5e8b008e46cc8Affected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 1656ecaddf90e2a070ec2d2404cdae3edf80facaAffected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 473aad9ad57ff760005377e6f45a2ad4210e08ceAffected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 260446eb8e5541402b271343a4516f2b33dec1e4Affected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before 46307adceb67bdf2ec38408dd9cebc378a6b5c46Affected
df2cf4a78e488d26728590cb3c6b4fe4c4862c77 to before f6da2267e71106474fbc0943dc24928b9cb79119Affected

LinuxLinux

4.3Affected
before 4.3Not affected
4.9.325 through 4.9.*Not affected
4.14.290 through 4.14.*Not affected
4.19.254 through 4.19.*Not affected
5.4.208 through 5.4.*Not affected
5.10.134 through 5.10.*Not affected
5.15.58 through 5.15.*Not affected
5.18.15 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.