CVE-2022-49205
bpf, sockmap: Fix double uncharge the mem of sk_msg
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of sk_msg If tcp_bpf_sendmsg is running during a tear down operation, psock may be freed. tcp_bpf_sendmsg() tcp_bpf_send_verdict() sk_msg_return() tcp_bpf_sendmsg_redir() unlikely(!psock)) sk_msg_free() The mem of msg has been uncharged in tcp_bpf_send_verdict() by sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock is null, we can simply returning an error code, this would then trigger the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have the side effect of throwing an error up to user space. This would be a slight change in behavior from user side but would look the same as an error if the redirect on the socket threw an error. This issue can cause the following info: WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 Call Trace: <TASK> __sk_destruct+0x24/0x1f0 sk_psock_destroy+0x19b/0x1c0 process_one_work+0x1b3/0x3c0 worker_thread+0x30/0x350 ? process_one_work+0x3c0/0x3c0 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.28% · top 79% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected 604326b41a6fb9b4a78b6179335decee0365cd8c – < 94c6ac22abcdede72bfaa0f4c22fb370891f4002
- affected 604326b41a6fb9b4a78b6179335decee0365cd8c – < cd84ea3920aef936c559b63099ef0013ce6b2325
- affected 604326b41a6fb9b4a78b6179335decee0365cd8c – < cb6f141ae705af0101e819065a79e6d029f6e393
- affected 604326b41a6fb9b4a78b6179335decee0365cd8c – < 223f3c51ab163852dd4819d357dcf33039929434
- affected 604326b41a6fb9b4a78b6179335decee0365cd8c – < ac3ecb7760c750c8e4fc09c719241d8e6e88028c
- affected 604326b41a6fb9b4a78b6179335decee0365cd8c – < 2486ab434b2c2a14e9237296db00b1e1b7ae3273
- affected 4.20
- unaffected < 4.20
- unaffected 5.4.189 – ≤ 5.4.*
- unaffected 5.10.110 – ≤ 5.10.*
- unaffected 5.15.33 – ≤ 5.15.*
- unaffected 5.16.19 – ≤ 5.16.*
- unaffected 5.17.2 – ≤ 5.17.*
- unaffected 5.18 – ≤ *
References (6)
- https://git.kernel.org/stable/c/94c6ac22abcdede72bfaa0f4c22fb370891f4002 (opens in a new tab)
- https://git.kernel.org/stable/c/cd84ea3920aef936c559b63099ef0013ce6b2325 (opens in a new tab)
- https://git.kernel.org/stable/c/cb6f141ae705af0101e819065a79e6d029f6e393 (opens in a new tab)
- https://git.kernel.org/stable/c/223f3c51ab163852dd4819d357dcf33039929434 (opens in a new tab)
- https://git.kernel.org/stable/c/ac3ecb7760c750c8e4fc09c719241d8e6e88028c (opens in a new tab)
- https://git.kernel.org/stable/c/2486ab434b2c2a14e9237296db00b1e1b7ae3273 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49205)Record last updated .