Skip to content
Fencer Vulns
medium 4.7

CVE-2022-49443 json

list: fix a data-race around ep->rdllist

published 2025-02-26 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2022-54786

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

list: fix a data-race around ep->rdllist

ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.

Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next.

Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless.

BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait

write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff88810480c7d0 -> 0xffff888103c15098

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Patch / fix

  • Linux Linux 5.15.46, 5.17.14, 5.18.3, 5.19
  • linux Debian 14, Debian 13, Debian 12 5.18.5-1

debian advisories DEBIAN-CVE-2022-49443

  • linux Ubuntu 22.04 LTS 5.15.0-47.51
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1019.23
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1017.23
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1015.18
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1013.15
  • linux-kvm Ubuntu 22.04 LTS 5.15.0-1017.21
  • linux-azure Ubuntu 22.04 LTS 5.15.0-1019.24
  • linux-gkeop Ubuntu 22.04 LTS 5.15.0-1002.4

ubuntu advisories UBUNTU-CVE-2022-49443

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-611.5.1.el9_7
  • rv RHEL 9 5.14.0-611.5.1.el9_7
  • perf RHEL 9 5.14.0-611.5.1.el9_7
  • rtla RHEL 9 5.14.0-611.5.1.el9_7
  • libperf RHEL 9 5.14.0-611.5.1.el9_7
  • kernel-rt RHEL 9 5.14.0-611.5.1.el9_7
  • kernel-64k RHEL 9 5.14.0-611.5.1.el9_7
  • kernel-core RHEL 9 5.14.0-611.5.1.el9_7

red hat advisories RHSA-2025:20518

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.100.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.100.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1.150500.6.47.1
  • kernel-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1
  • kernel-source-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1

suse advisories SUSE-SU-2025:1293-1SUSE-SU-2025:1241-1SUSE-SU-2025:1183-1SUSE-SU-2025:1176-1SUSE-SU-2025:1027-1

  • kernel AlmaLinux 9 5.14.0-611.5.1.el9_7
  • rv AlmaLinux 9 5.14.0-611.5.1.el9_7
  • perf AlmaLinux 9 5.14.0-611.5.1.el9_7
  • rtla AlmaLinux 9 5.14.0-611.5.1.el9_7
  • libperf AlmaLinux 9 5.14.0-611.5.1.el9_7
  • kernel-rt AlmaLinux 9 5.14.0-611.5.1.el9_7
  • kernel-64k AlmaLinux 9 5.14.0-611.5.1.el9_7
  • kernel-core AlmaLinux 9 5.14.0-611.5.1.el9_7

almalinux advisories ALSA-2025:20518

  • kernel Rocky Linux 9 5.14.0-611.5.1.el9_7

rocky linux advisories RLSA-2025:20518

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-49443 updated cvss 4.7

kernel: list: fix a data-race around ep->rdllist

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-611.5.1.el9_7, perf 5.14.0-611.5.1.el9_7, rtla 5.14.0-611.5.1.el9_7, python3-perf 5.14.0-611.5.1.el9_7, kernel-devel-matched 5.14.0-611.5.1.el9_7, kernel-64k-devel-matched 5.14.0-611.5.1.el9_7, +7 more Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-611.5.1.el9_7, kernel-64k 5.14.0-611.5.1.el9_7, kernel-core 5.14.0-611.5.1.el9_7, kernel-tools 5.14.0-611.5.1.el9_7, kernel-modules 5.14.0-611.5.1.el9_7, kernel-64k-core 5.14.0-611.5.1.el9_7, +27 more Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-s390x 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-x86_64 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-aarch64 5.14.0-611.5.1.el9_7, kernel-debuginfo-common-ppc64le 5.14.0-611.5.1.el9_7 Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-611.5.1.el9_7, kernel-rt-64k 5.14.0-611.5.1.el9_7, kernel-rt-core 5.14.0-611.5.1.el9_7, kernel-rt-modules 5.14.0-611.5.1.el9_7, kernel-rt-64k-core 5.14.0-611.5.1.el9_7, kernel-rt-debug-core 5.14.0-611.5.1.el9_7, +14 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-611.5.1.el9_7, kernel-rt-core 5.14.0-611.5.1.el9_7, kernel-rt-modules 5.14.0-611.5.1.el9_7, kernel-rt-debug-core 5.14.0-611.5.1.el9_7, kernel-rt-modules-core 5.14.0-611.5.1.el9_7, kernel-rt-debug-modules 5.14.0-611.5.1.el9_7, +4 more
    fixed: vendor fix RHSA-2025:20518
  • Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
13 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.