{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49998", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.387Z", "datePublished": "2025-06-18T11:00:57.940Z", "dateUpdated": "2026-08-05T08:57:06.559Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:06.559Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix locking in rxrpc's sendmsg\n\nFix three bugs in the rxrpc's sendmsg implementation:\n\n (1) rxrpc_new_client_call() should release the socket lock when returning\n an error from rxrpc_get_call_slot().\n\n (2) rxrpc_wait_for_tx_window_intr() will return without the call mutex\n held in the event that we're interrupted by a signal whilst waiting\n for tx space on the socket or relocking the call mutex afterwards.\n\n Fix this by: (a) moving the unlock/lock of the call mutex up to\n rxrpc_send_data() such that the lock is not held around all of\n rxrpc_wait_for_tx_window*() and (b) indicating to higher callers\n whether we're return with the lock dropped. Note that this means\n recvmsg() will not block on this call whilst we're waiting.\n\n (3) After dropping and regaining the call mutex, rxrpc_send_data() needs\n to go and recheck the state of the tx_pending buffer and the\n tx_total_len check in case we raced with another sendmsg() on the same\n call.\n\nThinking on this some more, it might make sense to have different locks for\nsendmsg() and recvmsg(). There's probably no need to make recvmsg() wait\nfor sendmsg(). It does mean that recvmsg() can return MSG_EOR indicating\nthat a call is dead before a sendmsg() to that call returns - but that can\ncurrently happen anyway.\n\nWithout fix (2), something like the following can be induced:\n\n\tWARNING: bad unlock balance detected!\n\t5.16.0-rc6-syzkaller #0 Not tainted\n\t-------------------------------------\n\tsyz-executor011/3597 is trying to release lock (&call->user_mutex) at:\n\t[] rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748\n\tbut there are no more locks to release!\n\n\tother info that might help us debug this:\n\tno locks held by syz-executor011/3597.\n\t...\n\tCall Trace:\n\t \n\t __dump_stack lib/dump_stack.c:88 [inline]\n\t dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n\t print_unlock_imbalance_bug include/trace/events/lock.h:58 [inline]\n\t __lock_release kernel/locking/lockdep.c:5306 [inline]\n\t lock_release.cold+0x49/0x4e kernel/locking/lockdep.c:5657\n\t __mutex_unlock_slowpath+0x99/0x5e0 kernel/locking/mutex.c:900\n\t rxrpc_do_sendmsg+0xc13/0x1350 net/rxrpc/sendmsg.c:748\n\t rxrpc_sendmsg+0x420/0x630 net/rxrpc/af_rxrpc.c:561\n\t sock_sendmsg_nosec net/socket.c:704 [inline]\n\t sock_sendmsg+0xcf/0x120 net/socket.c:724\n\t ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n\t ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n\t __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n\t do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n\t do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n\t entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n[Thanks to Hawkins Jiawei and Khalid Masum for their attempts to fix this]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is AF_RXRPC sendmsg() (socket → rxrpc_sendmsg → rxrpc_do_sendmsg → rxrpc_send_data → rxrpc_wait_for_tx_window_intr), a local syscall path. Remote packet receive does not execute this unlock/error path.\nAC:L - An unprivileged attacker controls both sides: fill the Tx window with sendmsg, deliver a signal during the unlocked wait/re-lock, and race a second thread on the same call/user_call_ID. No external timing or layout dependency is required.\nPR:L - rxrpc_create() has no capability checks; any unprivileged local user can open AF_RXRPC/SOCK_DGRAM (module autoloads via net-pf-33) and drive sendmsg without CAP_NET_ADMIN or init-namespace root.\nUI:N - The attacker creates the socket, sends data, signals their own wait, and races concurrent sendmsg themselves; no victim mount, open, or other interaction is required.\nS:U - Broken call-mutex exclusion corrupts kernel rxrpc/skb state within the same host kernel authority; there is no VM escape, IOMMU bypass, or sandbox boundary cross.\nC:H - Returning without user_mutex then writing call->tx_pending, plus unlocking while another sendmsg may hold the mutex (clearing ownership in unlock slowpath), enables concurrent access and skb UAF/double-free primitives that can disclose kernel memory.\nI:H - The same broken exclusion lets concurrent sendmsg mutate shared call/skb state (tx_pending, tx_total_len, queueing), yielding heap corruption suitable for arbitrary write and control-flow hijack, consistent with UAF/double-unlock scoring guidance.\nA:H - The demonstrated effect is a kernel bad-unlock-balance WARNING/oops path, and the resulting mutex/skb corruption can panic or hang the rxrpc send path; bug (1) also leaks the socket lock and can deadlock the socket." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rxrpc/call_object.c", "net/rxrpc/sendmsg.c" ], "versions": [ { "version": "bc5e3a546d553e5223851fc199e69040eb70f68b", "lessThan": "79e2ca7aa96e80961828ab6312264633b66183cc", "status": "affected", "versionType": "git" }, { "version": "bc5e3a546d553e5223851fc199e69040eb70f68b", "lessThan": "2bc769b8edb158be7379d15f36e23d66cf850053", "status": "affected", "versionType": "git" }, { "version": "bc5e3a546d553e5223851fc199e69040eb70f68b", "lessThan": "091dc91e119fdd61432347231724f4e861c6b465", "status": "affected", "versionType": "git" }, { "version": "bc5e3a546d553e5223851fc199e69040eb70f68b", "lessThan": "b0f571ecd7943423c25947439045f0d352ca3dbf", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rxrpc/call_object.c", "net/rxrpc/sendmsg.c" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.140", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.64", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.6", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/79e2ca7aa96e80961828ab6312264633b66183cc" }, { "url": "https://git.kernel.org/stable/c/2bc769b8edb158be7379d15f36e23d66cf850053" }, { "url": "https://git.kernel.org/stable/c/091dc91e119fdd61432347231724f4e861c6b465" }, { "url": "https://git.kernel.org/stable/c/b0f571ecd7943423c25947439045f0d352ca3dbf" } ], "title": "rxrpc: Fix locking in rxrpc's sendmsg", "x_generator": { "engine": "bippy-1.2.0" } } } }