CVE-2022-49087 – A race condition in the Linux kernel's rxrpc su... (How to Fix)

Q: What is the severity of CVE-2022-49087?

CVE-2022-49087 has a CVSS score of 7.8 (HIGH). A race condition in the Linux kernel's rxrpc subsystem allows a use-after-free vulnerability during network namespace cleanup. This can lead to kernel memory corruption and potential system crashes or privilege escalation. Systems running affected Linux kernel versions with rxrpc enabled are vulnerable.

📋 TL;DR

A race condition in the Linux kernel's rxrpc subsystem allows a use-after-free vulnerability during network namespace cleanup. This can lead to kernel memory corruption and potential system crashes or privilege escalation. Systems running affected Linux kernel versions with rxrpc enabled are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires rxrpc subsystem to be enabled/compiled in kernel. Most distributions enable this by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or potential privilege escalation leading to full system compromise.

🟠

Likely Case

System instability, kernel crashes, or denial of service.

🟢

If Mitigated

Minimal impact if rxrpc is disabled or systems are not using network namespaces extensively.

🌐 Internet-Facing: LOW - Requires local access or specific network namespace manipulation.

🏢 Internal Only: MEDIUM - Local users or processes could potentially trigger the race condition.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires race condition timing and local access. Exploitation is non-trivial but possible.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commit 08ff0e74fab5 or later

Vendor Advisory: https://git.kernel.org/stable/c/08ff0e74fab517dbc44e11b8bc683dd4ecc65950

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable rxrpc module

Linux

Prevent loading of rxrpc kernel module if not required

echo 'blacklist rxrpc' > /etc/modprobe.d/blacklist-rxrpc.conf
rmmod rxrpc

🧯 If You Can't Patch

Restrict local user access to minimize attack surface
Monitor system logs for kernel panic or ODEBUG warnings

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if rxrpc module is loaded: uname -r && lsmod | grep rxrpc

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check dmesg for absence of related warnings

📡 Detection & Monitoring

Log Indicators:

ODEBUG warnings about timer_list
Kernel panic logs
Use-after-free detection in kernel logs

Network Indicators:

Unusual network namespace activity

SIEM Query:

source="kernel" AND ("ODEBUG" OR "timer_list" OR "rxrpc_peer_keepalive")

📊 Metadata

CVE ID: CVE-2022-49087

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.05% exploit probability (16.4th percentile)

Published: February 26, 2025

Last Updated: March 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49087, you might also want to check these: