CVE-2022-49207— bpf, sockmap: Fix memleak in sk_psock_queue_msg
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国等都是美国(Linux)基金会的产品。Linux kernel是开源操作系统Linux所使用的内核。pillarjs send等都是(pillarjs)开源的产品。send是一个用于将文件从文件系统流式传输为 http 响应的库。Rancher rke等都是(Rancher)开源的产品。rke是一个极其简单、闪电般快速的 Kubernetes 安装程序。 Linux kernel存在安全漏洞，该漏洞源于sk_psock_queue_msg函数中的内存泄漏。
Possible ATT&CK Techniques 1 AI
T1498.002 · Reflection AmplificationAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9635720b7c88592214562cb72605bdab6708006c< ef9785f429794567792561a584901faa9291d3ee |
affected |
9635720b7c88592214562cb72605bdab6708006c< 4dd2e947d3be13a4de3b3028859b9a6497266bcf |
affected | ||
9635720b7c88592214562cb72605bdab6708006c< 03948ed6553960db62f1c33bec29e64d7c191a3f |
affected | ||
9635720b7c88592214562cb72605bdab6708006c< 938d3480b92fa5e454b7734294f12a7b75126f09 |
affected | ||
5.14 |
affected | ||
< 5.14 |
unaffected | ||
5.15.33≤ 5.15.* |
unaffected | ||
5.16.19≤ 5.16.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-49207
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bpf, sockmap: Fix memleak in sk_psock_queue_msg
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix memleak in sk_psock_queue_msg
If tcp_bpf_sendmsg is running during a tear down operation we may enqueue
data on the ingress msg queue while tear down is trying to free it.
sk1 (redirect sk2) sk2
------------------- ---------------
tcp_bpf_sendmsg()
tcp_bpf_send_verdict()
tcp_bpf_sendmsg_redir()
bpf_tcp_ingress()
sock_map_close()
lock_sock()
lock_sock() ... blocking
sk_psock_stop
sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);
release_sock(sk);
lock_sock()
sk_mem_charge()
get_page()
sk_psock_queue_msg()
sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED);
drop_sk_msg()
release_sock()
While drop_sk_msg(), the msg has charged memory form sk by sk_mem_charge
and has sg pages need to put. To fix we use sk_msg_free() and then kfee()
msg.
This issue can cause the following info:
WARNING: CPU: 0 PID: 9202 at net/core/stream.c:205 sk_stream_kill_queues+0xc8/0xe0
Call Trace:
<IRQ>
inet_csk_destroy_sock+0x55/0x110
tcp_rcv_state_process+0xe5f/0xe90
? sk_filter_trim_cap+0x10d/0x230
? tcp_v4_do_rcv+0x161/0x250
tcp_v4_do_rcv+0x161/0x250
tcp_v4_rcv+0xc3a/0xce0
ip_protocol_deliver_rcu+0x3d/0x230
ip_local_deliver_finish+0x54/0x60
ip_local_deliver+0xfd/0x110
? ip_protocol_deliver_rcu+0x230/0x230
ip_rcv+0xd6/0x100
? ip_local_deliver+0x110/0x110
__netif_receive_skb_one_core+0x85/0xa0
process_backlog+0xa4/0x160
__napi_poll+0x29/0x1b0
net_rx_action+0x287/0x300
__do_softirq+0xff/0x2fc
do_softirq+0x79/0x90
</IRQ>
WARNING: CPU: 0 PID: 531 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x175/0x1b0
Call Trace:
<TASK>
__sk_destruct+0x24/0x1f0
sk_psock_destroy+0x19b/0x1c0
process_one_work+0x1b3/0x3c0
? process_one_work+0x3c0/0x3c0
worker_thread+0x30/0x350
? process_one_work+0x3c0/0x3c0
kthread+0xe6/0x110
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x22/0x30
</TASK>
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国等都是美国(Linux)基金会的产品。Linux kernel是开源操作系统Linux所使用的内核。pillarjs send等都是(pillarjs)开源的产品。send是一个用于将文件从文件系统流式传输为 http 响应的库。Rancher rke等都是(Rancher)开源的产品。rke是一个极其简单、闪电般快速的 Kubernetes 安装程序。 Linux kernel存在安全漏洞，该漏洞源于sk_psock_queue_msg函数中的内存泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-49207
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-49207
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-49207 (4)
Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total
| CVE-2022-49149 | 9.8 CRITICAL | rxrpc: Fix call timer start racing with call destruction |
| CVE-2022-49280 | 9.8 CRITICAL | NFSD: prevent underflow in nfssvc_decode_writeargs() |
| CVE-2022-49561 | 9.8 CRITICAL | netfilter: conntrack: re-fetch conntrack after insertion |
| CVE-2022-49407 | 9.8 CRITICAL | dlm: fix plock invalid read |
| CVE-2022-49094 | 9.8 CRITICAL | net/tls: fix slab-out-of-bounds bug in decrypt_internal |
| CVE-2022-49362 | 9.8 CRITICAL | NFSD: Fix potential use-after-free in nfsd_file_put() |
| CVE-2022-49093 | 9.8 CRITICAL | skbuff: fix coalescing for page_pool fragment recycling |
| CVE-2022-49194 | 9.8 CRITICAL | net: bcmgenet: Use stronger register read/writes to assure ordering |
| CVE-2022-49356 | 9.8 CRITICAL | SUNRPC: Trap RDMA segment overflows |
| CVE-2022-49418 | 9.8 CRITICAL | NFSv4: Fix free of uninitialized nfs4_label on referral lookup. |
| CVE-2022-49201 | 9.8 CRITICAL | ibmvnic: fix race between xmit and reset |
| CVE-2022-49260 | 9.8 CRITICAL | crypto: hisilicon/sec - fix the aead software fallback for engine |
| CVE-2022-49058 | 9.1 CRITICAL | cifs: potential buffer overflow in handling symlinks |
| CVE-2022-49519 | 8.8 HIGH | ath10k: skip ath10k_halt during suspend for driver state RESTARTING |
| CVE-2022-49328 | 8.8 HIGH | mt76: fix use-after-free by removing a non-RCU wcid pointer |
| CVE-2022-49535 | 8.8 HIGH | scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI |
| CVE-2022-49138 | 8.8 HIGH | Bluetooth: hci_event: Ignore multiple conn complete events |
| CVE-2022-49479 | 8.8 HIGH | mt76: fix tx status related use-after-free race on station removal |
| CVE-2022-49114 | 8.8 HIGH | scsi: libfc: Fix use after free in fc_exch_abts_resp() |
| CVE-2022-49111 | 8.8 HIGH | Bluetooth: Fix use after free in hci_send_acl |
Showing top 20 of 706 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
Same vendor: Linux
-
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria -
CVE-2026-80724
ptp: vmclock: prevent read-only mappings from becoming writa -
CVE-2026-80722
wifi: mac80211: validate individual TWT params before driver -
CVE-2026-80723
of: reserved_mem: prevent OOB when too many dynamic regions -
CVE-2026-80720
iomap: add a separate bio_set for iomap_split_ioend
V. Comments for CVE-2022-49207
No comments yet