CVE-2022-49602

ip: Fix a data-race around sysctl_fwmark_reflect.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ip: Fix a data-race around sysctl_fwmark_reflect.

While reading sysctl_fwmark_reflect, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	e110861f86094cd78cc85593b873970092deb43a to before fc92e3b4bebfdd986ef1d2c5019f236837b0b982Affected e110861f86094cd78cc85593b873970092deb43a to before 5e7a1be3e68deef250ad43cc91f7bb8d7d758b48Affected e110861f86094cd78cc85593b873970092deb43a to before 9096edcf4854289f92252e086cf6e498c7f8c21dAffected e110861f86094cd78cc85593b873970092deb43a to before 25a635a67c830766110410fea88ec4e6ee29684bAffected e110861f86094cd78cc85593b873970092deb43a to before 0ee76fe01ff3c0b4efaa500aecc90d7c8d3a8860Affected e110861f86094cd78cc85593b873970092deb43a to before dccf8a67f30e18980d13f07006e5a536bbd1e136Affected e110861f86094cd78cc85593b873970092deb43a to before a475ecc9ad919aa3ebdd4e4a6ee612b793bf74b3Affected e110861f86094cd78cc85593b873970092deb43a to before 85d0b4dbd74b95cc492b1f4e34497d3f894f5d9aAffected
LinuxLinux	3.16Affected before 3.16Not affected 4.9.325 through 4.9.Not affected 4.14.290 through 4.14.Not affected 4.19.254 through 4.19.Not affected 5.4.208 through 5.4.Not affected 5.10.134 through 5.10.Not affected 5.15.58 through 5.15.Not affected 5.18.15 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

e110861f86094cd78cc85593b873970092deb43a to before fc92e3b4bebfdd986ef1d2c5019f236837b0b982Affected
e110861f86094cd78cc85593b873970092deb43a to before 5e7a1be3e68deef250ad43cc91f7bb8d7d758b48Affected
e110861f86094cd78cc85593b873970092deb43a to before 9096edcf4854289f92252e086cf6e498c7f8c21dAffected
e110861f86094cd78cc85593b873970092deb43a to before 25a635a67c830766110410fea88ec4e6ee29684bAffected
e110861f86094cd78cc85593b873970092deb43a to before 0ee76fe01ff3c0b4efaa500aecc90d7c8d3a8860Affected
e110861f86094cd78cc85593b873970092deb43a to before dccf8a67f30e18980d13f07006e5a536bbd1e136Affected
e110861f86094cd78cc85593b873970092deb43a to before a475ecc9ad919aa3ebdd4e4a6ee612b793bf74b3Affected
e110861f86094cd78cc85593b873970092deb43a to before 85d0b4dbd74b95cc492b1f4e34497d3f894f5d9aAffected

LinuxLinux

3.16Affected
before 3.16Not affected
4.9.325 through 4.9.*Not affected
4.14.290 through 4.14.*Not affected
4.19.254 through 4.19.*Not affected
5.4.208 through 5.4.*Not affected
5.10.134 through 5.10.*Not affected
5.15.58 through 5.15.*Not affected
5.18.15 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.