Vulnerability in Linux
CVE-2022-49640
In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data races in proc_douintvec_minmax(). A sysctl variable is accessed concurrently, and there is always a chance of data-race. So, all readers and writers need some basic protection to avoid load/store-tearing. This patch changes proc_douintvec_minmax() to use READ_ONCE() and WRITE_ONCE() internally to fix data-races on the sysctl side. For now, proc_douintvec_minmax() itself is tolerant to a data-race, but we still need to add annotations on the other subsystem's side.
Vulnerability class: Race Condition
EPSS: 0.002 (7.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions 61d9b56a89208d8cccd0b4cfec7e6959717e16e3, 4.13, 0
- Linux Linux_kernel — versions 5.19
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2022-49640?
- CVE-2022-49640 is a medium-severity vulnerability in Linux, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 4.7/10. Published 2025-02-26.
- How severe is CVE-2022-49640?
- Medium severity. CVSS v3 base score is 4.7 out of 10.