SB20250226661 - Race condition within a thread in Linux kernel net
Published: February 26, 2025 Updated: May 11, 2025
Security Bulletin ID
SB20250226661
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition within a thread (CVE-ID: CVE-2022-49604)
The vulnerability allows a local user to corrupt data.
The vulnerability exists due to a data race within the ip_mtu_from_fib_result() function in net/ipv4/route.c. A local user can corrupt data.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/60c158dc7b1f0558f6cadd5b50d0386da0000d50
- https://git.kernel.org/stable/c/7828309df0f89419a9349761a37c7d1b0da45697
- https://git.kernel.org/stable/c/93fbc06da1d819f3981a7bd7928c3641ea67b364
- https://git.kernel.org/stable/c/b96ed5ccb09ae71103023ed13acefb194f609794
- https://git.kernel.org/stable/c/e364b5f6ffbfc457a997ad09a7baa16c19581edc
- https://git.kernel.org/stable/c/eb15262128b793e4b1d1c4514d3e6d19c3959764
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.254