LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49339: net: ipv6: unexport __init-annotated seg6_hmac_init()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport __init-annotated seg6_hmac_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the caller (net/ipv6/seg6.c) and the callee (net/ipv6/seg6_hmac.c) belong to the same module. It seems an internal function call in ipv6.ko.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49339 is a Linux kernel issue where an IPv6 Segment Routing HMAC initialization function was exported even though its code is discarded after boot. A later module reference could call freed kernel code and cause a kernel panic. The sources do not provide CVSS, confirmed exploitation, or evidence of data theft.

Executive priority

Treat this as a kernel stability and availability issue for normal patch governance unless additional vendor evidence raises severity. There is no source-backed active exploitation signal, but affected Linux kernels should still be updated because kernel panics can disrupt critical services.

Technical view

The vulnerable pattern is EXPORT_SYMBOL on seg6_hmac_init(), which is annotated __init. The .init.text section is freed after initialization, so exporting that symbol creates a possible use-after-free style kernel crash path. The upstream fix removes the export because the caller and callee are internal to ipv6.ko.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or downstream builds that include the vulnerable export. The bundle lists Linux kernel versions around 4.10 through 5.19 and stable update points. Exact distribution exposure depends on vendor backports and kernel packaging.

Exploitation context

The source bundle does not show active exploitation, public weaponization, or CISA KEV listing. The described impact is kernel panic from access to freed initialization code, likely a denial-of-service condition if reachable in a given build and module configuration.

Researcher notes

This was detected when modpost warnings were restored and appeared in linux-next builds. The fix choice was to remove EXPORT_SYMBOL, not remove __init, because net/ipv6/seg6.c and net/ipv6/seg6_hmac.c are in the same ipv6.ko module. Reachability beyond this description is not established in the bundle.

Mitigation direction

  • Update to a Linux kernel or vendor package containing the referenced stable fix.
  • Check distribution advisories for backported patches before relying on upstream version numbers.
  • Prioritize internet-facing or multi-tenant Linux hosts during routine kernel patch cycles.
  • If patching is delayed, follow vendor guidance; no source-backed runtime workaround is provided.

Validation and detection

  • Inventory running kernel versions and vendor package release levels across Linux assets.
  • Confirm whether vendor kernel changelogs include CVE-2022-49339 or the referenced stable commits.
  • For custom kernels, verify seg6_hmac_init is no longer exported while annotated __init.
  • Review kernel panic history for related IPv6 or Segment Routing module crashes.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49339 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936c, bf355b8d2c30a289232042cacc1cfaea4923936cunaffected
LinuxLinux4.10, 0, 4.14.283, 4.19.247, 5.4.198, 5.10.122, 5.15.47, 5.17.15, 5.18.4, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.