Skip to content
Fencer Vulns
high 7.8

CVE-2022-49696 json

tipc: fix use-after-free Read in tipc_named_reinit

published 2025-02-26 20 mo ago modified 2026-08-05 3 mo ago also EUVD-2022-54539

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix use-after-free Read in tipc_named_reinit

syzbot found the following issue on: ================================================================== BUG: KASAN: use-after-free in tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 Read of size 8 at addr ffff88805299a000 by task kworker/1:9/23764

CPU: 1 PID: 23764 Comm: kworker/1:9 Not tainted 5.18.0-rc4-syzkaller-00878-g17d49e6e8012 #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tipc_named_reinit+0x94f/0x9b0 net/tipc/name_distr.c:413 tipc_net_finalize+0x234/0x3d0 net/tipc/net.c:138 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK> [...] ==================================================================

In the commit d966ddcc3821 ("tipc: fix a deadlock when flushing scheduled work"), the cancel_work_sync() function just to make sure ONLY the work tipc_net_finalize_work() is executing/pending on any CPU completed before tipc namespace is destroyed through tipc_exit_net(). But this function is not guaranteed the work is the last queued. So, the destroyed instance may be accessed in the work which will try to enqueue later.

In order to completely fix, we re-order the calling of cancel_work_sync() to make sure the work tipc_net_finalize_work() was last queued and it must be completed by calling cancel_work_sync().

Patch / fix

  • Linux Linux 5.5, 5.10, 5.10.127, 5.15.51, 5.18.8, 5.19
  • linux Debian 14, Debian 13, Debian 12 5.18.14-1

debian advisories DEBIAN-CVE-2022-49696

  • linux Ubuntu 22.04 LTS 5.15.0-48.54
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1020.24
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1018.24
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1016.19
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1015.17
  • linux-kvm Ubuntu 22.04 LTS 5.15.0-1018.22
  • linux-azure Ubuntu 22.04 LTS 5.15.0-1020.25
  • linux-gkeop Ubuntu 22.04 LTS 5.15.0-1003.5

ubuntu advisories UBUNTU-CVE-2022-49696

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • perf RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • bpftool RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • kernel-core RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • kernel-tools RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • python3-perf RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • kernel-modules RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4.18.0-372.149.1.el8_6
  • kernel-zfcpdump RHEL 8.6 E4S 4.18.0-372.149.1.el8_6

red hat advisories RHSA-2025:9498RHSA-2025:9494RHSA-2025:9497RHSA-2025:9493

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-49696 updated cvss 7.1

kernel: tipc: fix use-after-free Read in tipc_named_reinit

  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-core, kernel-tools, python3-perf, +17 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    affected: no fix available
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perf 5.14.0-70.134.1.el9_0, kernel-devel-matched 5.14.0-70.134.1.el9_0, kernel-debug-devel-matched 5.14.0-70.134.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.134.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.134.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.134.1.el9_0, +2 more
    fixed: vendor fix RHSA-2025:9494
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) perf 4.18.0-305.159.1.el8_4, kernel 4.18.0-305.159.1.el8_4, bpftool 4.18.0-305.159.1.el8_4, kernel-core 4.18.0-305.159.1.el8_4, kernel-tools 4.18.0-305.159.1.el8_4, python3-perf 4.18.0-305.159.1.el8_4, +8 more
    fixed: vendor fix RHSA-2025:9497
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.149.1.el8_6, kernel 4.18.0-372.149.1.el8_6, bpftool 4.18.0-372.149.1.el8_6, kernel-core 4.18.0-372.149.1.el8_6, kernel-tools 4.18.0-372.149.1.el8_6, python3-perf 4.18.0-372.149.1.el8_6, +8 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) perf 4.18.0-372.149.1.el8_6, kernel 4.18.0-372.149.1.el8_6, bpftool 4.18.0-372.149.1.el8_6, kernel-core 4.18.0-372.149.1.el8_6, kernel-tools 4.18.0-372.149.1.el8_6, python3-perf 4.18.0-372.149.1.el8_6, +15 more
    fixed: vendor fix RHSA-2025:9498
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) kernel 5.14.0-70.134.1.el9_0, bpftool 5.14.0-70.134.1.el9_0, kernel-core 5.14.0-70.134.1.el9_0, kernel-tools 5.14.0-70.134.1.el9_0, python3-perf 5.14.0-70.134.1.el9_0, kernel-modules 5.14.0-70.134.1.el9_0, +14 more
    fixed: vendor fix RHSA-2025:9494
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) perf 4.18.0-372.149.1.el8_6, kernel 4.18.0-372.149.1.el8_6, bpftool 4.18.0-372.149.1.el8_6, kernel-core 4.18.0-372.149.1.el8_6, kernel-tools 4.18.0-372.149.1.el8_6, python3-perf 4.18.0-372.149.1.el8_6, +8 more
    fixed: vendor fix RHSA-2025:9498
  • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-kvm 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-core 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-modules 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-debug-kvm 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-debug-core 5.14.0-70.134.1.rt21.206.el9_0, +4 more Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-core 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-modules 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-debug-core 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-debug-modules 5.14.0-70.134.1.rt21.206.el9_0, kernel-rt-modules-extra 5.14.0-70.134.1.rt21.206.el9_0, +2 more
    fixed: vendor fix RHSA-2025:9493
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +6 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.