CVE-2022-48786 vsock: remove vsock from connected table when connect is interrupted by a signal

High 7.8 Published 16 Jul 2024 Updated 5 Aug 2026

A race condition in the Linux kernel vsock implementation allows list corruption, potentially leading to memory corruption or denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-48786?

CVE-2022-48786 is a high-severity memory corruption vulnerability in Linux kernel, published on 16 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

vsock: remove vsock from connected table when connect is interrupted by a signal

vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task wakes up with a signal pending. If this happens the socket will be in the connected table, and it is not removed when the socket state is reset. In this situation it's common for the process to retry connect(), and if the connection is successful the socket will be added to the connected table a second time, corrupting the list.

Prevent this by calling vsock_remove_connected() if a signal is received while waiting for a connection. This is harmless if the socket is not in the connected table, and if it is in the table then removing it will prevent list corruption from a double add.

Note for backporting: this patch requires d5afa82c977e ("vsock: correct removal of socket from the list"), which is in all current stable trees except 4.9.y.

Which versions are affected by CVE-2022-48786?

It affects 1 product.

Linux distribution packages (40)

`bpftool` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`bpftool-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-abi-stablelists` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-core` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-core` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-devel` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-modules` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-modules-extra` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-devel` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-doc` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-modules` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-modules-extra` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-tools` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-tools-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-tools-libs` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`perf` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`perf-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`python3-perf` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`python3-perf-debuginfo` Red Hat:rhel_aus:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`bpftool` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`bpftool-debuginfo` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-abi-stablelists` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-core` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-core` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-debuginfo` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-devel` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-modules` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debug-modules-extra` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo-common-aarch64` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo-common-ppc64le` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo-common-s390x` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_e4s:8.6::baseos	All versions	`0:4.18.0-372.131.1.el8_6`

Products include Linux kernel.

How do I fix CVE-2022-48786?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-48786 being exploited?

There is no known exploitation of CVE-2022-48786 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-48786, GHSA-qv99-r3jr-9wm2, RHSA-2024:10273, UBUNTU-CVE-2022-48786.