Riskcovery

CVE-2022-49641

sysctl: Fix data races in proc_douintvec().

State
Published
Severity
4.7 Medium
Published
Feb 26, 2025
Updated
May 23, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

sysctl: Fix data races in proc_douintvec().

A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing.

This patch changes proc_douintvec() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_douintvec() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side.

Scores

CVSSScoreVectorSource
3.14.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
LinuxLinux
  • e7d316a02f683864a12389f8808570e37fb90aa3 to before d5d54714e329f646bd7af4994fc427d88ee68936Affected
  • e7d316a02f683864a12389f8808570e37fb90aa3 to before d335db59f7fb3353f56e52371f1ee796ae9c8f09Affected
  • e7d316a02f683864a12389f8808570e37fb90aa3 to before 630c76850d554d7140232e71b5d1663e88cffb54Affected
  • e7d316a02f683864a12389f8808570e37fb90aa3 to before 4762b532ec9539755aab61445d5da6e1926ccb99Affected
  • 70cd763eb1574cac07138be91f474a661e02d694Affected
  • f4cea51e9a3d536e2ca2b74a958f7c0b4ea733c3Affected
  • 4.4.24 to before 4.5Affected
  • 4.7.7 to before 4.8Affected
LinuxLinux
  • 4.8Affected
  • before 4.8Not affected
  • 5.10.132 through 5.10.*Not affected
  • 5.15.56 through 5.15.*Not affected
  • 5.18.13 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.