CVE-2022-49596

tcp: Fix data-races around sysctl_tcp_min_snd_mss.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 23, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix data-races around sysctl_tcp_min_snd_mss.

While reading sysctl_tcp_min_snd_mss, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before fdb96b69f5909ffcdd6f1e0902219fc6d7689ff7Affected 5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 97992e8feff33b3ae154a113ec398546bbacda80Affected 5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 0fc9357282df055e30990b29f4b7afa53ab42cdbAffected 5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 0d8a39feb58910a7f7746b1770ee5578cc551fe6Affected 5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 78eb166cdefcc3221c8c7c1e2d514e91a2eb5014Affected 6b7e7997ad3505db7de85ff12276fc84659481d3Affected e757d052f3b8ce739d068a1e890643376c16b7a9Affected 8e39cbc03dafa3731d22533f869bf326c0e6e6f8Affected cd6f35b8421ff20365ff711c0ac7647fd70e9af7Affected 7f9f8a37e563c67b24ccd57da1d541a95538e8d9Affected 2efabe3e1491f10bf3cf82ae1a371755ba054a1bAffected 3.16.69 to before 3.17Affected 4.4.182 to before 4.5Affected 4.9.182 to before 4.10Affected 4.14.127 to before 4.15Affected 4.19.52 to before 4.20Affected 5.1.11 to before 5.2Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.4.208 through 5.4.Not affected 5.10.134 through 5.10.Not affected 5.15.58 through 5.15.Not affected 5.18.15 through 5.18.Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before fdb96b69f5909ffcdd6f1e0902219fc6d7689ff7Affected
5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 97992e8feff33b3ae154a113ec398546bbacda80Affected
5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 0fc9357282df055e30990b29f4b7afa53ab42cdbAffected
5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 0d8a39feb58910a7f7746b1770ee5578cc551fe6Affected
5f3e2bf008c2221478101ee72f5cb4654b9fc363 to before 78eb166cdefcc3221c8c7c1e2d514e91a2eb5014Affected
6b7e7997ad3505db7de85ff12276fc84659481d3Affected
e757d052f3b8ce739d068a1e890643376c16b7a9Affected
8e39cbc03dafa3731d22533f869bf326c0e6e6f8Affected
cd6f35b8421ff20365ff711c0ac7647fd70e9af7Affected
7f9f8a37e563c67b24ccd57da1d541a95538e8d9Affected
2efabe3e1491f10bf3cf82ae1a371755ba054a1bAffected
3.16.69 to before 3.17Affected
4.4.182 to before 4.5Affected
4.9.182 to before 4.10Affected
4.14.127 to before 4.15Affected
4.19.52 to before 4.20Affected
5.1.11 to before 5.2Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.4.208 through 5.4.*Not affected
5.10.134 through 5.10.*Not affected
5.15.58 through 5.15.*Not affected
5.18.15 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.