CVE-2022-49149

Q: What is the severity of CVE-2022-49149?

CVE-2022-49149 has a CVSS score of 4.7 (MEDIUM). A race condition in the Linux kernel's rxrpc subsystem allows a timer to be restarted while a call is being destroyed, potentially leading to a kernel oops (crash). This affects Linux systems using the rxrpc module for remote procedure calls. Attackers could cause denial of service by triggering this race condition.

4.7 MEDIUM

Denial of Service

📋 TL;DR

A race condition in the Linux kernel's rxrpc subsystem allows a timer to be restarted while a call is being destroyed, potentially leading to a kernel oops (crash). This affects Linux systems using the rxrpc module for remote procedure calls. Attackers could cause denial of service by triggering this race condition.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before fixes in stable branches (specific commits listed in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if rxrpc module is loaded and in use

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service

🟠

Likely Case

Kernel oops causing system instability or service disruption

🟢

If Mitigated

Minor performance impact with proper kernel protections

🌐 Internet-Facing: LOW - Requires specific rxrpc usage and network access

🏢 Internal Only: LOW - Requires local access or specific network configuration

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Requires precise timing to trigger race condition and specific rxrpc usage

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in stable kernel versions via commits listed in references

Vendor Advisory: https://git.kernel.org/stable/c/4a7f62f91933c8ae5308f9127fd8ea48188b6bc3

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable rxrpc module

linux

Unload rxrpc module if not required

sudo modprobe -r rxrpc

Blacklist rxrpc module

linux

Prevent rxrpc module from loading

echo 'blacklist rxrpc' | sudo tee /etc/modprobe.d/rxrpc-blacklist.conf

🧯 If You Can't Patch

Ensure rxrpc module is not loaded if not required
Implement network segmentation to limit access to rxrpc services

🔍 How to Verify

Check if Vulnerable:

Check if rxrpc module is loaded: lsmod | grep rxrpc

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched releases from your distribution

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages in /var/log/kern.log or dmesg
System crash/panic logs

Network Indicators:

Unusual rxrpc traffic patterns

SIEM Query:

source="kernel" AND ("oops" OR "panic") AND "rxrpc"

📊 Metadata

CVE ID: CVE-2022-49149

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

EPSS Score: 0.03% exploit probability (7.1th percentile)

Published: February 26, 2025

Last Updated: September 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable rxrpc module

Blacklist rxrpc module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities