CVE-2022-49600

ip: Fix a data-race around sysctl_ip_autobind_reuse.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ip: Fix a data-race around sysctl_ip_autobind_reuse.

While reading sysctl_ip_autobind_reuse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	4b01a9674231a97553a55456d883f584e948a78d to before 611ba70e5aca252ef43374dda97ed4cf1c47a07cAffected 4b01a9674231a97553a55456d883f584e948a78d to before 87ceaa199a72c5856d49a030941fabcd5c3928d4Affected 4b01a9674231a97553a55456d883f584e948a78d to before fa7cdcf9b28d13aac1eeb34b948db8a18e041341Affected 4b01a9674231a97553a55456d883f584e948a78d to before 0db232765887d9807df8bcb7b6f29b2871539eabAffected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.134 through 5.10.Not affected 5.15.58 through 5.15.Not affected 5.18.15 through 5.18.*Not affected 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.