CVE-2022-49639

cipso: Fix data-races around sysctl.

State: Published
Severity: 4.7 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

cipso: Fix data-races around sysctl.

While reading cipso sysctl variables, they can be changed concurrently. So, we need to add READ_ONCE() to avoid data-races.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 2764f82bbc158d106693ae3ced3675cf4b963b35Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before c321e99d2725d11f7e6a4ebd9ce752259f0bae81Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before ca26ca5e2f3eeb3e6fe699cd6effa3b4b2aa8698Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 0e41a0f73ccb9be112a80bde3804a771633caaefAffected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before fe2a35fa2c4f9c8ce5ef970eb927031387f9446aAffected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 07b0caf8aeb9b82e6ecc6c292a3e47c7fcdb1148Affected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 59e26906b89cc35bb54476498772b45cbc32323fAffected 446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before dd44f04b9214adb68ef5684ae87a81ba03632250Affected
LinuxLinux	2.6.19Affected before 2.6.19Not affected 4.9.324 through 4.9.Not affected 4.14.289 through 4.14.Not affected 4.19.253 through 4.19.Not affected 5.4.207 through 5.4.Not affected 5.10.132 through 5.10.Not affected 5.15.56 through 5.15.Not affected 5.18.13 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 2764f82bbc158d106693ae3ced3675cf4b963b35Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before c321e99d2725d11f7e6a4ebd9ce752259f0bae81Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before ca26ca5e2f3eeb3e6fe699cd6effa3b4b2aa8698Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 0e41a0f73ccb9be112a80bde3804a771633caaefAffected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before fe2a35fa2c4f9c8ce5ef970eb927031387f9446aAffected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 07b0caf8aeb9b82e6ecc6c292a3e47c7fcdb1148Affected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before 59e26906b89cc35bb54476498772b45cbc32323fAffected
446fda4f26822b2d42ab3396aafcedf38a9ff2b6 to before dd44f04b9214adb68ef5684ae87a81ba03632250Affected

LinuxLinux

2.6.19Affected
before 2.6.19Not affected
4.9.324 through 4.9.*Not affected
4.14.289 through 4.14.*Not affected
4.19.253 through 4.19.*Not affected
5.4.207 through 5.4.*Not affected
5.10.132 through 5.10.*Not affected
5.15.56 through 5.15.*Not affected
5.18.13 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.