Vulnerability in Linux
CVE-2022-49967
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a data-race around bpf_jit_limit. While reading bpf_jit_limit, it can be changed concurrently via sysctl, WRITE_ONCE() in __do_proc_doulongvec_minmax(). The size of bpf_jit_limit is long, so we need to add a paired READ_ONCE() to avoid load-tearing.
Vulnerability class: Race Condition
EPSS: 0.001 (2.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions 4.19.47, ede95a63b5e84ddeea6b0c473b36ab8bfd8c6ce3, 5.19.8
- Linux Linux_kernel — versions 6.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2022-49967?
- CVE-2022-49967 is a medium-severity vulnerability in Linux, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 4.7/10. Published 2025-06-18.
- How severe is CVE-2022-49967?
- Medium severity. CVSS v3 base score is 4.7 out of 10.