CVE-2022-49634

sysctl: Fix data-races in proc_dou8vec_minmax().

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

sysctl: Fix data-races in proc_dou8vec_minmax().

A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing.

This patch changes proc_dou8vec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_dou8vec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	389dab6142d742f91010f38de0f1f2f440b97e1b to before f177b382c33900d0e5a9766493c11a1074076f78Affected cb9444130662c6c13022579c861098f212db2562 to before e58b02e445463065b4078bf621561da75197853fAffected cb9444130662c6c13022579c861098f212db2562 to before 5f776daef0b5354615ec4b4234cd9539ca05f273Affected cb9444130662c6c13022579c861098f212db2562 to before 7dee5d7747a69aa2be41f04c6a7ecfe3ac8cdf18Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.56 through 5.15.Not affected 5.18.13 through 5.18.Not affected 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.