CVE-2022-49149 rxrpc: Fix call timer start racing with call destruction
A race condition in the Linux kernel's rxrpc module can cause a system crash when a call timer is restarted during call destruction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49149?
CVE-2022-49149 is a critical vulnerability in Linux kernel, published on 26 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix call timer start racing with call destruction
The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq mode with just the RCU read lock held. Unfortunately, because only the RCU read lock is held - and neither ref or other lock is taken - the call can start getting destroyed at the same time a packet comes in addressed to that call. This causes the timer - which was already stopped - to get restarted. Later, the timer dispatch code may then oops if the timer got deallocated first.
Fix this by trying to take a ref on the rxrpc_call struct and, if successful, passing that ref along to the timer. If the timer was already running, the ref is discarded.
The timer completion routine can then pass the ref along to the call's work item when it queues it. If the timer or work item where already queued/running, the extra ref is discarded.
Weakness: CWE-362
Which versions are affected by CVE-2022-49149?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49149?
Apply the vendor's patch.
Is CVE-2022-49149 being exploited?
There is no known exploitation of CVE-2022-49149 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49149, GHSA-g36j-w8h6-jr97, UBUNTU-CVE-2022-49149.