CVE-2022-49089: linux Race Condition
Vulnerability summary
CVE-2022-49089 is a high (CVSS 7.8) Race Condition vulnerability in linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 26-02-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition The documentation of the function rvt_error_qp says both r_lock and s_lock need to be held when calling that function. It also asserts using lockdep that both of those locks are held. However, the commit I referenced in Fixes accidentally makes the call to rvt_error_qp in rvt_ruc_loopback no longer covered by r_lock. This results in the lockdep assertion failing and also possibly in a race condition.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.19% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Affected systems
Ubuntu102 products
- linux< 5.4.0-117.132 | < 5.15.0-37.39
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.4.0-1078.84 | < 5.15.0-1011.14
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ d757c60eca9b22f4d108929a24401e0fdecda0b1, < 8a50937227c385a477177c9ffa122b4230e40666 | ≥ d757c60eca9b22f4d108929a24401e0fdecda0b1, < 43c2d7890ecabe527448a6c391fb2d9a5e6bbfe0 | ≥ d757c60eca9b22f4d108929a24401e0fdecda0b1, < 92f1947c0d26060e978b3a9f21f32ce7c8c9cca3 | ≥ d757c60eca9b22f4d108929a24401e0fdecda0b1, < 77ffb2495a41098f9d6a14f8aefde3188da75944 | ≥ d757c60eca9b22f4d108929a24401e0fdecda0b1, < 57800cc36e55db0547461c49acf5cd84c0f502b0 | ≥ d757c60eca9b22f4d108929a24401e0fdecda0b1, < 4d809f69695d4e7d1378b3a072fa9aef23123018 | 25636de95557a95d54ac30be94af3748345a0a90 | ≥ 5.0.4, < 5.1 | 5.1
- linux_kernel≥ 5.0.4, < 5.4.189 | ≥ 5.5, < 5.10.111 | ≥ 5.11, < 5.15.34 | ≥ 5.16, < 5.16.20 | ≥ 5.17, < 5.17.3 | 5.18:rc1
Debian1 product
- linux< 5.17.3-1
3 vendors · 105 products
