CVE-2022-49604

ip: Fix data-races around sysctl_ip_fwd_use_pmtu.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ip: Fix data-races around sysctl_ip_fwd_use_pmtu.

While reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before eb15262128b793e4b1d1c4514d3e6d19c3959764Affected f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before 7828309df0f89419a9349761a37c7d1b0da45697Affected f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before b96ed5ccb09ae71103023ed13acefb194f609794Affected f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before 93fbc06da1d819f3981a7bd7928c3641ea67b364Affected f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before e364b5f6ffbfc457a997ad09a7baa16c19581edcAffected f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before 60c158dc7b1f0558f6cadd5b50d0386da0000d50Affected
LinuxLinux	3.14Affected before 3.14Not affected 4.19.254 through 4.19.Not affected 5.4.208 through 5.4.Not affected 5.10.134 through 5.10.Not affected 5.15.58 through 5.15.Not affected 5.18.15 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before eb15262128b793e4b1d1c4514d3e6d19c3959764Affected
f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before 7828309df0f89419a9349761a37c7d1b0da45697Affected
f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before b96ed5ccb09ae71103023ed13acefb194f609794Affected
f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before 93fbc06da1d819f3981a7bd7928c3641ea67b364Affected
f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before e364b5f6ffbfc457a997ad09a7baa16c19581edcAffected
f87c10a8aa1e82498c42d0335524d6ae7cf5a52b to before 60c158dc7b1f0558f6cadd5b50d0386da0000d50Affected

LinuxLinux

3.14Affected
before 3.14Not affected
4.19.254 through 4.19.*Not affected
5.4.208 through 5.4.*Not affected
5.10.134 through 5.10.*Not affected
5.15.58 through 5.15.*Not affected
5.18.15 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.