CVE-2022-49641
CVSS 3.1 Score 4.7 of 10 (medium)
Details
Published Feb 26, 2025
Updated: Mar 11, 2025
CWE ID 362
Summary
CVE-2022-49641 involves a data race issue in the Linux kernel's sysctl function, specifically in proc_douintvec(). This vulnerability arises due to concurrent access to a sysctl variable, increasing the risk of data inconsistency. To mitigate this, the patch introduces the use of READ_ONCE() and WRITE_ONCE() internally in proc_douintvec() to prevent data races on the sysctl side. Although proc_douintvec() is currently resilient to data races, further annotations are required on other subsystems to ensure comprehensive protection.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.