GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49207 (GCVE-0-2022-49207)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-05-11 18:55
VLAI
Title
bpf, sockmap: Fix memleak in sk_psock_queue_msg
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in sk_psock_queue_msg If tcp_bpf_sendmsg is running during a tear down operation we may enqueue data on the ingress msg queue while tear down is trying to free it. sk1 (redirect sk2) sk2 ------------------- --------------- tcp_bpf_sendmsg() tcp_bpf_send_verdict() tcp_bpf_sendmsg_redir() bpf_tcp_ingress() sock_map_close() lock_sock() lock_sock() ... blocking sk_psock_stop sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED); release_sock(sk); lock_sock() sk_mem_charge() get_page() sk_psock_queue_msg() sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED); drop_sk_msg() release_sock() While drop_sk_msg(), the msg has charged memory form sk by sk_mem_charge and has sg pages need to put. To fix we use sk_msg_free() and then kfee() msg. This issue can cause the following info: WARNING: CPU: 0 PID: 9202 at net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0 Call Trace: <IRQ> inet_csk_destroy_sock+0x55/0x110 tcp_rcv_state_process+0xe5f/0xe90 ? sk_filter_trim_cap+0x10d/0x230 ? tcp_v4_do_rcv+0x161/0x250 tcp_v4_do_rcv+0x161/0x250 tcp_v4_rcv+0xc3a/0xce0 ip_protocol_deliver_rcu+0x3d/0x230 ip_local_deliver_finish+0x54/0x60 ip_local_deliver+0xfd/0x110 ? ip_protocol_deliver_rcu+0x230/0x230 ip_rcv+0xd6/0x100 ? ip_local_deliver+0x110/0x110 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0xa4/0x160 __napi_poll+0x29/0x1b0 net_rx_action+0x287/0x300 __do_softirq+0xff/0x2fc do_softirq+0x79/0x90 </IRQ> WARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0 Call Trace: <TASK> __sk_destruct+0x24/0x1f0 sk_psock_destroy+0x19b/0x1c0 process_one_work+0x1b3/0x3c0 ? process_one_work+0x3c0/0x3c0 worker_thread+0x30/0x350 ? process_one_work+0x3c0/0x3c0 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:47 UTC
CWE
  • CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9635720b7c88592214562cb72605bdab6708006c , < ef9785f429794567792561a584901faa9291d3ee (git)
Affected: 9635720b7c88592214562cb72605bdab6708006c , < 4dd2e947d3be13a4de3b3028859b9a6497266bcf (git)
Affected: 9635720b7c88592214562cb72605bdab6708006c , < 03948ed6553960db62f1c33bec29e64d7c191a3f (git)
Affected: 9635720b7c88592214562cb72605bdab6708006c , < 938d3480b92fa5e454b7734294f12a7b75126f09 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49207",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:47:03.450960Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-401",
                "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:47:06.855Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skmsg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef9785f429794567792561a584901faa9291d3ee",
              "status": "affected",
              "version": "9635720b7c88592214562cb72605bdab6708006c",
              "versionType": "git"
            },
            {
              "lessThan": "4dd2e947d3be13a4de3b3028859b9a6497266bcf",
              "status": "affected",
              "version": "9635720b7c88592214562cb72605bdab6708006c",
              "versionType": "git"
            },
            {
              "lessThan": "03948ed6553960db62f1c33bec29e64d7c191a3f",
              "status": "affected",
              "version": "9635720b7c88592214562cb72605bdab6708006c",
              "versionType": "git"
            },
            {
              "lessThan": "938d3480b92fa5e454b7734294f12a7b75126f09",
              "status": "affected",
              "version": "9635720b7c88592214562cb72605bdab6708006c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skmsg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix memleak in sk_psock_queue_msg\n\nIf tcp_bpf_sendmsg is running during a tear down operation we may enqueue\ndata on the ingress msg queue while tear down is trying to free it.\n\n sk1 (redirect sk2)                         sk2\n -------------------                      ---------------\ntcp_bpf_sendmsg()\n tcp_bpf_send_verdict()\n  tcp_bpf_sendmsg_redir()\n   bpf_tcp_ingress()\n                                          sock_map_close()\n                                           lock_sock()\n    lock_sock() ... blocking\n                                           sk_psock_stop\n                                            sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);\n                                           release_sock(sk);\n    lock_sock()\n    sk_mem_charge()\n    get_page()\n    sk_psock_queue_msg()\n     sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED);\n      drop_sk_msg()\n    release_sock()\n\nWhile drop_sk_msg(), the msg has charged memory form sk by sk_mem_charge\nand has sg pages need to put. To fix we use sk_msg_free() and then kfee()\nmsg.\n\nThis issue can cause the following info:\nWARNING: CPU: 0 PID: 9202 at net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0\nCall Trace:\n \u003cIRQ\u003e\n inet_csk_destroy_sock+0x55/0x110\n tcp_rcv_state_process+0xe5f/0xe90\n ? sk_filter_trim_cap+0x10d/0x230\n ? tcp_v4_do_rcv+0x161/0x250\n tcp_v4_do_rcv+0x161/0x250\n tcp_v4_rcv+0xc3a/0xce0\n ip_protocol_deliver_rcu+0x3d/0x230\n ip_local_deliver_finish+0x54/0x60\n ip_local_deliver+0xfd/0x110\n ? ip_protocol_deliver_rcu+0x230/0x230\n ip_rcv+0xd6/0x100\n ? ip_local_deliver+0x110/0x110\n __netif_receive_skb_one_core+0x85/0xa0\n process_backlog+0xa4/0x160\n __napi_poll+0x29/0x1b0\n net_rx_action+0x287/0x300\n __do_softirq+0xff/0x2fc\n do_softirq+0x79/0x90\n \u003c/IRQ\u003e\n\nWARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x24/0x1f0\n sk_psock_destroy+0x19b/0x1c0\n process_one_work+0x1b3/0x3c0\n ? process_one_work+0x3c0/0x3c0\n worker_thread+0x30/0x350\n ? process_one_work+0x3c0/0x3c0\n kthread+0xe6/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:55:13.064Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef9785f429794567792561a584901faa9291d3ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dd2e947d3be13a4de3b3028859b9a6497266bcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/03948ed6553960db62f1c33bec29e64d7c191a3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/938d3480b92fa5e454b7734294f12a7b75126f09"
        }
      ],
      "title": "bpf, sockmap: Fix memleak in sk_psock_queue_msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49207",
    "datePublished": "2025-02-26T01:55:46.177Z",
    "dateReserved": "2025-02-26T01:49:39.291Z",
    "dateUpdated": "2026-05-11T18:55:13.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49207",
      "date": "2026-09-16",
      "epss": "0.00263",
      "percentile": "0.18329"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49207\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:57.817\",\"lastModified\":\"2026-06-17T05:17:22.997\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Fix memleak in sk_psock_queue_msg\\n\\nIf tcp_bpf_sendmsg is running during a tear down operation we may enqueue\\ndata on the ingress msg queue while tear down is trying to free it.\\n\\n sk1 (redirect sk2)                         sk2\\n -------------------                      ---------------\\ntcp_bpf_sendmsg()\\n tcp_bpf_send_verdict()\\n  tcp_bpf_sendmsg_redir()\\n   bpf_tcp_ingress()\\n                                          sock_map_close()\\n                                           lock_sock()\\n    lock_sock() ... blocking\\n                                           sk_psock_stop\\n                                            sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);\\n                                           release_sock(sk);\\n    lock_sock()\\n    sk_mem_charge()\\n    get_page()\\n    sk_psock_queue_msg()\\n     sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED);\\n      drop_sk_msg()\\n    release_sock()\\n\\nWhile drop_sk_msg(), the msg has charged memory form sk by sk_mem_charge\\nand has sg pages need to put. To fix we use sk_msg_free() and then kfee()\\nmsg.\\n\\nThis issue can cause the following info:\\nWARNING: CPU: 0 PID: 9202 at net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0\\nCall Trace:\\n \u003cIRQ\u003e\\n inet_csk_destroy_sock+0x55/0x110\\n tcp_rcv_state_process+0xe5f/0xe90\\n ? sk_filter_trim_cap+0x10d/0x230\\n ? tcp_v4_do_rcv+0x161/0x250\\n tcp_v4_do_rcv+0x161/0x250\\n tcp_v4_rcv+0xc3a/0xce0\\n ip_protocol_deliver_rcu+0x3d/0x230\\n ip_local_deliver_finish+0x54/0x60\\n ip_local_deliver+0xfd/0x110\\n ? ip_protocol_deliver_rcu+0x230/0x230\\n ip_rcv+0xd6/0x100\\n ? ip_local_deliver+0x110/0x110\\n __netif_receive_skb_one_core+0x85/0xa0\\n process_backlog+0xa4/0x160\\n __napi_poll+0x29/0x1b0\\n net_rx_action+0x287/0x300\\n __do_softirq+0xff/0x2fc\\n do_softirq+0x79/0x90\\n \u003c/IRQ\u003e\\n\\nWARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0\\nCall Trace:\\n \u003cTASK\u003e\\n __sk_destruct+0x24/0x1f0\\n sk_psock_destroy+0x19b/0x1c0\\n process_one_work+0x1b3/0x3c0\\n ? process_one_work+0x3c0/0x3c0\\n worker_thread+0x30/0x350\\n ? process_one_work+0x3c0/0x3c0\\n kthread+0xe6/0x110\\n ? kthread_complete_and_exit+0x20/0x20\\n ret_from_fork+0x22/0x30\\n \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf, sockmap: Corregir p\u00e9rdida de memoria en sk_psock_queue_msg Si tcp_bpf_sendmsg se est\u00e1 ejecutando durante una operaci\u00f3n de desmontaje, podemos poner en cola datos en la cola de mensajes de entrada mientras el desmontaje intenta liberarlos. sk1 (redireccionar sk2) sk2 ------------------- --------------- tcp_bpf_sendmsg() tcp_bpf_send_verdict() tcp_bpf_sendmsg_redir() bpf_tcp_ingress() sock_map_close() lock_sock() lock_sock() ... bloqueando sk_psock_stop sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED); release_sock(sk); lock_sock() sk_mem_charge() get_page() sk_psock_queue_msg() sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED); drop_sk_msg() release_sock() Mientras se usa drop_sk_msg(), el mensaje ha cargado la memoria del formulario sk mediante sk_mem_charge y tiene p\u00e1ginas sg que se deben colocar. Para solucionarlo, usamos sk_msg_free() y luego kfee() msg. Este problema puede causar la siguiente informaci\u00f3n: ADVERTENCIA: CPU: 0 PID: 9202 en net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0 Rastreo de llamadas:  inet_csk_destroy_sock+0x55/0x110 tcp_rcv_state_process+0xe5f/0xe90 ? sk_filter_trim_cap+0x10d/0x230 ? tcp_v4_do_rcv+0x161/0x250 tcp_v4_do_rcv+0x161/0x250 tcp_v4_rcv+0xc3a/0xce0 ip_protocol_deliver_rcu+0x3d/0x230 ip_local_deliver_finish+0x54/0x60 ip_local_deliver+0xfd/0x110 ? ip_protocol_deliver_rcu+0x230/0x230 ip_rcv+0xd6/0x100 ? ip_local_deliver+0x110/0x110 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0xa4/0x160 __napi_poll+0x29/0x1b0 net_rx_action+0x287/0x300 __do_softirq+0xff/0x2fc do_softirq+0x79/0x90  WARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0 Call Trace:  __sk_destruct+0x24/0x1f0 sk_psock_destroy+0x19b/0x1c0 process_one_work+0x1b3/0x3c0 ? process_one_work+0x3c0/0x3c0 worker_thread+0x30/0x350 ? process_one_work+0x3c0/0x3c0 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/skmsg.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9635720b7c88592214562cb72605bdab6708006c\",\"lessThan\":\"ef9785f429794567792561a584901faa9291d3ee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9635720b7c88592214562cb72605bdab6708006c\",\"lessThan\":\"4dd2e947d3be13a4de3b3028859b9a6497266bcf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9635720b7c88592214562cb72605bdab6708006c\",\"lessThan\":\"03948ed6553960db62f1c33bec29e64d7c191a3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9635720b7c88592214562cb72605bdab6708006c\",\"lessThan\":\"938d3480b92fa5e454b7734294f12a7b75126f09\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/skmsg.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:47:03.450960Z\",\"id\":\"CVE-2022-49207\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"FB1C7FD1-C89E-4955-B265-456A9F757302\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03948ed6553960db62f1c33bec29e64d7c191a3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4dd2e947d3be13a4de3b3028859b9a6497266bcf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/938d3480b92fa5e454b7734294f12a7b75126f09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef9785f429794567792561a584901faa9291d3ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:27:22+00:00",
      "cve": "CVE-2022-49207",
      "id": "CVE-2022-49207",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, sockmap: Fix memleak in sk_psock_queue_msg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49207.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:35:11Z",
      "cve": "CVE-2022-49207",
      "id": "CVE-2022-49207",
      "initial_release_date": "2025-02-27T03:10:38Z",
      "product_status:known_affected": "425",
      "product_status:known_not_affected": "344",
      "product_status:recommended": "127",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49207",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49207.json",
      "version": "39"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49207\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:47:03.450960Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-401\", \"description\": \"CWE-401 Missing Release of Memory after Effective Lifetime\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:09:15.299Z\"}}], \"cna\": {\"title\": \"bpf, sockmap: Fix memleak in sk_psock_queue_msg\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9635720b7c88592214562cb72605bdab6708006c\", \"lessThan\": \"ef9785f429794567792561a584901faa9291d3ee\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9635720b7c88592214562cb72605bdab6708006c\", \"lessThan\": \"4dd2e947d3be13a4de3b3028859b9a6497266bcf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9635720b7c88592214562cb72605bdab6708006c\", \"lessThan\": \"03948ed6553960db62f1c33bec29e64d7c191a3f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9635720b7c88592214562cb72605bdab6708006c\", \"lessThan\": \"938d3480b92fa5e454b7734294f12a7b75126f09\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/skmsg.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/skmsg.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ef9785f429794567792561a584901faa9291d3ee\"}, {\"url\": \"https://git.kernel.org/stable/c/4dd2e947d3be13a4de3b3028859b9a6497266bcf\"}, {\"url\": \"https://git.kernel.org/stable/c/03948ed6553960db62f1c33bec29e64d7c191a3f\"}, {\"url\": \"https://git.kernel.org/stable/c/938d3480b92fa5e454b7734294f12a7b75126f09\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, sockmap: Fix memleak in sk_psock_queue_msg\\n\\nIf tcp_bpf_sendmsg is running during a tear down operation we may enqueue\\ndata on the ingress msg queue while tear down is trying to free it.\\n\\n sk1 (redirect sk2)                         sk2\\n -------------------                      ---------------\\ntcp_bpf_sendmsg()\\n tcp_bpf_send_verdict()\\n  tcp_bpf_sendmsg_redir()\\n   bpf_tcp_ingress()\\n                                          sock_map_close()\\n                                           lock_sock()\\n    lock_sock() ... blocking\\n                                           sk_psock_stop\\n                                            sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);\\n                                           release_sock(sk);\\n    lock_sock()\\n    sk_mem_charge()\\n    get_page()\\n    sk_psock_queue_msg()\\n     sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED);\\n      drop_sk_msg()\\n    release_sock()\\n\\nWhile drop_sk_msg(), the msg has charged memory form sk by sk_mem_charge\\nand has sg pages need to put. To fix we use sk_msg_free() and then kfee()\\nmsg.\\n\\nThis issue can cause the following info:\\nWARNING: CPU: 0 PID: 9202 at net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0\\nCall Trace:\\n \u003cIRQ\u003e\\n inet_csk_destroy_sock+0x55/0x110\\n tcp_rcv_state_process+0xe5f/0xe90\\n ? sk_filter_trim_cap+0x10d/0x230\\n ? tcp_v4_do_rcv+0x161/0x250\\n tcp_v4_do_rcv+0x161/0x250\\n tcp_v4_rcv+0xc3a/0xce0\\n ip_protocol_deliver_rcu+0x3d/0x230\\n ip_local_deliver_finish+0x54/0x60\\n ip_local_deliver+0xfd/0x110\\n ? ip_protocol_deliver_rcu+0x230/0x230\\n ip_rcv+0xd6/0x100\\n ? ip_local_deliver+0x110/0x110\\n __netif_receive_skb_one_core+0x85/0xa0\\n process_backlog+0xa4/0x160\\n __napi_poll+0x29/0x1b0\\n net_rx_action+0x287/0x300\\n __do_softirq+0xff/0x2fc\\n do_softirq+0x79/0x90\\n \u003c/IRQ\u003e\\n\\nWARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0\\nCall Trace:\\n \u003cTASK\u003e\\n __sk_destruct+0x24/0x1f0\\n sk_psock_destroy+0x19b/0x1c0\\n process_one_work+0x1b3/0x3c0\\n ? process_one_work+0x3c0/0x3c0\\n worker_thread+0x30/0x350\\n ? process_one_work+0x3c0/0x3c0\\n kthread+0xe6/0x110\\n ? kthread_complete_and_exit+0x20/0x20\\n ret_from_fork+0x22/0x30\\n \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.33\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.19\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.2\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:55:13.064Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49207\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:55:13.064Z\", \"dateReserved\": \"2025-02-26T01:49:39.291Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:55:46.177Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.