GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49443 (GCVE-0-2022-49443)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:12 – Updated: 2026-05-11 18:59
VLAI
Title
list: fix a data-race around ep->rdllist
Summary
In the Linux kernel, the following vulnerability has been resolved: list: fix a data-race around ep->rdllist ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing. Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next. Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless. BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff88810480c7d0 -> 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:40 UTC
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bf3b9f6372c45b0fbf24d86b8794910d20170017 , < 5d5d993f16be15d124be7b8ec71b28ef7b7dc3af (git)
Affected: bf3b9f6372c45b0fbf24d86b8794910d20170017 , < cb3e48f7a35033deb9455abe3932e63cb500b9eb (git)
Affected: bf3b9f6372c45b0fbf24d86b8794910d20170017 , < e039c0b5985999b150594126225e1ee51df7b4c9 (git)
Affected: bf3b9f6372c45b0fbf24d86b8794910d20170017 , < d679ae94fdd5d3ab00c35078f5af5f37e068b03d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:40:52.947192Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:49.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/list.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5d5d993f16be15d124be7b8ec71b28ef7b7dc3af",
              "status": "affected",
              "version": "bf3b9f6372c45b0fbf24d86b8794910d20170017",
              "versionType": "git"
            },
            {
              "lessThan": "cb3e48f7a35033deb9455abe3932e63cb500b9eb",
              "status": "affected",
              "version": "bf3b9f6372c45b0fbf24d86b8794910d20170017",
              "versionType": "git"
            },
            {
              "lessThan": "e039c0b5985999b150594126225e1ee51df7b4c9",
              "status": "affected",
              "version": "bf3b9f6372c45b0fbf24d86b8794910d20170017",
              "versionType": "git"
            },
            {
              "lessThan": "d679ae94fdd5d3ab00c35078f5af5f37e068b03d",
              "status": "affected",
              "version": "bf3b9f6372c45b0fbf24d86b8794910d20170017",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/list.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlist: fix a data-race around ep-\u003erdllist\n\nep_poll() first calls ep_events_available() with no lock held and checks\nif ep-\u003erdllist is empty by list_empty_careful(), which reads\nrdllist-\u003eprev.  Thus all accesses to it need some protection to avoid\nstore/load-tearing.\n\nNote INIT_LIST_HEAD_RCU() already has the annotation for both prev\nand next.\n\nCommit bf3b9f6372c4 (\"epoll: Add busy poll support to epoll with socket\nfds.\") added the first lockless ep_events_available(), and commit\nc5a282e9635e (\"fs/epoll: reduce the scope of wq lock in epoll_wait()\")\nmade some ep_events_available() calls lockless and added single call under\na lock, finally commit e59d3c64cba6 (\"epoll: eliminate unnecessary lock\nfor zero timeout\") made the last ep_events_available() lockless.\n\nBUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait\n\nwrite to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:\n INIT_LIST_HEAD include/linux/list.h:38 [inline]\n list_splice_init include/linux/list.h:492 [inline]\n ep_start_scan fs/eventpoll.c:622 [inline]\n ep_send_events fs/eventpoll.c:1656 [inline]\n ep_poll fs/eventpoll.c:1806 [inline]\n do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nread to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:\n list_empty_careful include/linux/list.h:329 [inline]\n ep_events_available fs/eventpoll.c:381 [inline]\n ep_poll fs/eventpoll.c:1797 [inline]\n do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nvalue changed: 0xffff88810480c7d0 -\u003e 0xffff888103c15098\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G        W         5.17.0-rc7-syzkaller-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:59:55.294Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5d5d993f16be15d124be7b8ec71b28ef7b7dc3af"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb3e48f7a35033deb9455abe3932e63cb500b9eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e039c0b5985999b150594126225e1ee51df7b4c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d679ae94fdd5d3ab00c35078f5af5f37e068b03d"
        }
      ],
      "title": "list: fix a data-race around ep-\u003erdllist",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49443",
    "datePublished": "2025-02-26T02:12:55.959Z",
    "dateReserved": "2025-02-26T02:08:31.571Z",
    "dateUpdated": "2026-05-11T18:59:55.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49443",
      "date": "2026-09-16",
      "epss": "0.00178",
      "percentile": "0.07585"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49443\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:20.730\",\"lastModified\":\"2026-06-17T05:18:03.853\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlist: fix a data-race around ep-\u003erdllist\\n\\nep_poll() first calls ep_events_available() with no lock held and checks\\nif ep-\u003erdllist is empty by list_empty_careful(), which reads\\nrdllist-\u003eprev.  Thus all accesses to it need some protection to avoid\\nstore/load-tearing.\\n\\nNote INIT_LIST_HEAD_RCU() already has the annotation for both prev\\nand next.\\n\\nCommit bf3b9f6372c4 (\\\"epoll: Add busy poll support to epoll with socket\\nfds.\\\") added the first lockless ep_events_available(), and commit\\nc5a282e9635e (\\\"fs/epoll: reduce the scope of wq lock in epoll_wait()\\\")\\nmade some ep_events_available() calls lockless and added single call under\\na lock, finally commit e59d3c64cba6 (\\\"epoll: eliminate unnecessary lock\\nfor zero timeout\\\") made the last ep_events_available() lockless.\\n\\nBUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait\\n\\nwrite to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:\\n INIT_LIST_HEAD include/linux/list.h:38 [inline]\\n list_splice_init include/linux/list.h:492 [inline]\\n ep_start_scan fs/eventpoll.c:622 [inline]\\n ep_send_events fs/eventpoll.c:1656 [inline]\\n ep_poll fs/eventpoll.c:1806 [inline]\\n do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234\\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nread to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:\\n list_empty_careful include/linux/list.h:329 [inline]\\n ep_events_available fs/eventpoll.c:381 [inline]\\n ep_poll fs/eventpoll.c:1797 [inline]\\n do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234\\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nvalue changed: 0xffff88810480c7d0 -\u003e 0xffff888103c15098\\n\\nReported by Kernel Concurrency Sanitizer on:\\nCPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G        W         5.17.0-rc7-syzkaller-dirty #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: list: se corrige una ejecuci\u00f3n de datos alrededor de ep-\u0026gt;rdllist ep_poll() primero llama a ep_events_available() sin bloqueo mantenido y verifica si ep-\u0026gt;rdllist est\u00e1 vac\u00edo mediante list_empty_careful(), que lee rdllist-\u0026gt;prev. Por lo tanto, todos los accesos a \u00e9l necesitan alguna protecci\u00f3n para evitar el desgarro de almacenamiento/carga. Tenga en cuenta que INIT_LIST_HEAD_RCU() ya tiene la anotaci\u00f3n tanto para prev como para next. El commit bf3b9f6372c4 (\\\"epoll: Agregar soporte de sondeo ocupado a epoll con fds de socket\\\") agreg\u00f3 el primer ep_events_available() sin bloqueo, y el commit c5a282e9635e (\\\"fs/epoll: reducir el alcance del bloqueo wq en epoll_wait()\\\") hizo que algunas llamadas ep_events_available() no tuvieran bloqueo y agreg\u00f3 una sola llamada bajo un bloqueo, finalmente el commit e59d3c64cba6 (\\\"epoll: eliminar el bloqueo innecesario para tiempo de espera cero\\\") hizo que el \u00faltimo ep_events_available() no tuviera bloqueo. ERROR: KCSAN: data-race in do_epoll_wait / do_epoll_wait write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff88810480c7d0 -\u0026gt; 0xffff888103c15098 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/list.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bf3b9f6372c45b0fbf24d86b8794910d20170017\",\"lessThan\":\"5d5d993f16be15d124be7b8ec71b28ef7b7dc3af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf3b9f6372c45b0fbf24d86b8794910d20170017\",\"lessThan\":\"cb3e48f7a35033deb9455abe3932e63cb500b9eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf3b9f6372c45b0fbf24d86b8794910d20170017\",\"lessThan\":\"e039c0b5985999b150594126225e1ee51df7b4c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bf3b9f6372c45b0fbf24d86b8794910d20170017\",\"lessThan\":\"d679ae94fdd5d3ab00c35078f5af5f37e068b03d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/list.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.46\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:40:52.947192Z\",\"id\":\"CVE-2022-49443\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.12\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"1C85B4FC-DF18-4C4C-AA30-7705B44192E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d5d993f16be15d124be7b8ec71b28ef7b7dc3af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb3e48f7a35033deb9455abe3932e63cb500b9eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d679ae94fdd5d3ab00c35078f5af5f37e068b03d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e039c0b5985999b150594126225e1ee51df7b4c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-23T23:46:55+00:00",
      "cve": "CVE-2022-49443",
      "id": "CVE-2022-49443",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: list: fix a data-race around ep-\u003erdllist",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49443.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:27:58Z",
      "cve": "CVE-2022-49443",
      "id": "CVE-2022-49443",
      "initial_release_date": "2025-02-27T03:06:48Z",
      "product_status:known_affected": "496",
      "product_status:known_not_affected": "191",
      "product_status:recommended": "290",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49443",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49443.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49443\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:40:52.947192Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:47:07.049Z\"}}], \"cna\": {\"title\": \"list: fix a data-race around ep-\u003erdllist\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bf3b9f6372c45b0fbf24d86b8794910d20170017\", \"lessThan\": \"5d5d993f16be15d124be7b8ec71b28ef7b7dc3af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf3b9f6372c45b0fbf24d86b8794910d20170017\", \"lessThan\": \"cb3e48f7a35033deb9455abe3932e63cb500b9eb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf3b9f6372c45b0fbf24d86b8794910d20170017\", \"lessThan\": \"e039c0b5985999b150594126225e1ee51df7b4c9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf3b9f6372c45b0fbf24d86b8794910d20170017\", \"lessThan\": \"d679ae94fdd5d3ab00c35078f5af5f37e068b03d\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/list.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/list.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5d5d993f16be15d124be7b8ec71b28ef7b7dc3af\"}, {\"url\": \"https://git.kernel.org/stable/c/cb3e48f7a35033deb9455abe3932e63cb500b9eb\"}, {\"url\": \"https://git.kernel.org/stable/c/e039c0b5985999b150594126225e1ee51df7b4c9\"}, {\"url\": \"https://git.kernel.org/stable/c/d679ae94fdd5d3ab00c35078f5af5f37e068b03d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlist: fix a data-race around ep-\u003erdllist\\n\\nep_poll() first calls ep_events_available() with no lock held and checks\\nif ep-\u003erdllist is empty by list_empty_careful(), which reads\\nrdllist-\u003eprev.  Thus all accesses to it need some protection to avoid\\nstore/load-tearing.\\n\\nNote INIT_LIST_HEAD_RCU() already has the annotation for both prev\\nand next.\\n\\nCommit bf3b9f6372c4 (\\\"epoll: Add busy poll support to epoll with socket\\nfds.\\\") added the first lockless ep_events_available(), and commit\\nc5a282e9635e (\\\"fs/epoll: reduce the scope of wq lock in epoll_wait()\\\")\\nmade some ep_events_available() calls lockless and added single call under\\na lock, finally commit e59d3c64cba6 (\\\"epoll: eliminate unnecessary lock\\nfor zero timeout\\\") made the last ep_events_available() lockless.\\n\\nBUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait\\n\\nwrite to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0:\\n INIT_LIST_HEAD include/linux/list.h:38 [inline]\\n list_splice_init include/linux/list.h:492 [inline]\\n ep_start_scan fs/eventpoll.c:622 [inline]\\n ep_send_events fs/eventpoll.c:1656 [inline]\\n ep_poll fs/eventpoll.c:1806 [inline]\\n do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234\\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nread to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1:\\n list_empty_careful include/linux/list.h:329 [inline]\\n ep_events_available fs/eventpoll.c:381 [inline]\\n ep_poll fs/eventpoll.c:1797 [inline]\\n do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234\\n do_epoll_pwait fs/eventpoll.c:2268 [inline]\\n __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline]\\n __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275\\n __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nvalue changed: 0xffff88810480c7d0 -\u003e 0xffff888103c15098\\n\\nReported by Kernel Concurrency Sanitizer on:\\nCPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G        W         5.17.0-rc7-syzkaller-dirty #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.46\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.14\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.3\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"4.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:59:55.294Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49443\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:59:55.294Z\", \"dateReserved\": \"2025-02-26T02:08:31.571Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:12:55.959Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.