Riskcovery

CVE-2022-49957

kcm: fix strp_init() order and cleanup

State
Published
Severity
Not scored
Published
Jun 18, 2025
Updated
May 27, 2026
Reserved
Jun 18, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

kcm: fix strp_init() order and cleanup

strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work.

And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check.

This also makes a lockdep warning reported by syzbot go away.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 44890e9ff771ef11777b2d1ebf8589255eb12502 to before 473f394953216614087f4179e55cdf0cf616a13bAffected
  • e5571240236c5652f3e079b1d5866716a7ad819c to before a8a0c321319ad64a5427d6172cd9c23b4d6ca1e8Affected
  • e5571240236c5652f3e079b1d5866716a7ad819c to before 0946ff31d1a8778787bf6708beb20f38715267ccAffected
  • e5571240236c5652f3e079b1d5866716a7ad819c to before 1b6666964ca1de93a7bf06e122bcf3616dbd33a9Affected
  • e5571240236c5652f3e079b1d5866716a7ad819c to before 55fb8c3baa8071c5d533a9ad48624e44e2a04ef5Affected
  • e5571240236c5652f3e079b1d5866716a7ad819c to before f865976baa85915c7672f351b74d5974b93215f6Affected
  • e5571240236c5652f3e079b1d5866716a7ad819c to before 8fc29ff3910f3af08a7c40a75d436b5720efe2bfAffected
  • 085cbbda4b4cc7dd2ba63806346881c2c2e10107Affected
  • 383250363daf01eb7aa3728c09ef8a4f6d8a3252Affected
  • 19042316b9e12c93bf334a04d4dd7a4e846c7311Affected
  • 4.14.22 to before 4.14.293Affected
  • 4.9.84 to before 4.10Affected
  • 4.9.100 to before 4.10Affected
LinuxLinux
  • 4.15Affected
  • before 4.15Not affected
  • 4.14.293 through 4.14.*Not affected
  • 4.19.258 through 4.19.*Not affected
  • 5.4.213 through 5.4.*Not affected
  • 5.10.142 through 5.10.*Not affected
  • 5.15.66 through 5.15.*Not affected
  • 5.19.8 through 5.19.*Not affected
  • 6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.