SB20250226668 - Race condition within a thread in Linux kernel ipv4
Published: February 26, 2025 Updated: May 11, 2025
Security Bulletin ID
SB20250226668
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition within a thread (CVE-ID: CVE-2022-49637)
The vulnerability allows a local user to corrupt data.
The vulnerability exists due to a data race within the tnode_free() function in net/ipv4/fib_trie.c. A local user can corrupt data.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/190cd4ff128373271e065afb20f1d2247b3f10c3
- https://git.kernel.org/stable/c/418b191d5f223a8cb6cab09eae1f72c04ba6adf2
- https://git.kernel.org/stable/c/73318c4b7dbd0e781aaababff17376b2894745c0
- https://git.kernel.org/stable/c/7c1acd98fb221dc0d847451b9ab86319f8b9916c
- https://git.kernel.org/stable/c/9be8aac91960ea32fd0e874758c9afee665c57d2
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.56