CVE-2022-49593

Q: What is the severity of CVE-2022-49593?

CVE-2022-49593 has a CVSS score of 4.7 (MEDIUM). This CVE describes a race condition vulnerability in the Linux kernel's TCP implementation where the sysctl_tcp_probe_interval variable can be read while being modified concurrently. This could lead to inconsistent or incorrect TCP probe timing behavior. It affects Linux systems with vulnerable kernel versions.

4.7 MEDIUM

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's TCP implementation where the sysctl_tcp_probe_interval variable can be read while being modified concurrently. This could lead to inconsistent or incorrect TCP probe timing behavior. It affects Linux systems with vulnerable kernel versions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable kernel versions referenced in the git commits (exact ranges depend on distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: All Linux systems with the vulnerable kernel code are affected, but impact depends on TCP probe usage.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Inconsistent TCP probe timing could potentially cause network instability, connection timeouts, or degraded network performance in specific configurations.

🟠

Likely Case

Minimal to no practical impact in most environments as this is a low-severity race condition affecting a specific TCP timing parameter.

🟢

If Mitigated

No impact if patched or if the affected TCP probe functionality is not being used.

🌐 Internet-Facing: LOW - This affects internal TCP timing parameters and doesn't provide direct attack vectors for external exploitation.

🏢 Internal Only: LOW - Even internally, this requires specific conditions and provides minimal attack surface.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

This is a race condition requiring precise timing and specific conditions to trigger any observable effect.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with the git commits referenced in the CVE description

Vendor Advisory: https://git.kernel.org/stable/c/2a85388f1d94a9f8b5a529118a2c5eaa0520d85c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable TCP probe functionality

linux

Set sysctl_tcp_probe_interval to 0 to disable TCP probe timing

sysctl -w net.ipv4.tcp_probe_interval=0

🧯 If You Can't Patch

Monitor systems for network instability or TCP connection issues
Consider implementing network segmentation to limit blast radius

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's security advisories for affected versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version from vendor advisory

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing TCP probe timing anomalies or network stack warnings

Network Indicators:

Unexpected TCP connection timeouts or retransmissions

SIEM Query:

Search for kernel version strings matching vulnerable versions in system inventory data

📊 Metadata

CVE ID: CVE-2022-49593

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

EPSS Score: 0.03% exploit probability (7.2th percentile)

Published: February 26, 2025

Last Updated: October 1, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable TCP probe functionality

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities