LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context

In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A new passive FastOpen TCP socket is created. This FO socket waits for an ACK coming from client to be a complete ESTABLISHED one. 2) A socket operation on this socket goes through lock_sock() release_sock() dance. 3) While the socket is owned by the user in step 2), a retransmit of the SYN is received and stored in socket backlog. 4) At release_sock() time, the socket backlog is processed while in process context. 5) A SYNACK packet is cooked in response of the SYN retransmit. 6) -> tcp_rtx_synack() is called in process context. Before blamed commit, tcp_rtx_synack() was always called from BH handler, from a timer handler. Fix this by using TCP_INC_STATS() & NET_INC_STATS() which do not assume caller is in non preemptible context. [1] BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 caller is tcp_rtx_synack.part.0+0x36/0xc0 CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 Call Trace: <TASK> dump_stack_lvl+0x48/0x5e check_preemption_disabled+0xde/0xe0 tcp_rtx_synack.part.0+0x36/0xc0 tcp_rtx_synack+0x8d/0xa0 ? kmem_cache_alloc+0x2e0/0x3e0 ? apparmor_file_alloc_security+0x3b/0x1f0 inet_rtx_syn_ack+0x16/0x30 tcp_check_req+0x367/0x610 tcp_rcv_state_process+0x91/0xf60 ? get_nohz_timer_target+0x18/0x1a0 ? lock_timer_base+0x61/0x80 ? preempt_count_add+0x68/0xa0 tcp_v4_do_rcv+0xbd/0x270 __release_sock+0x6d/0xb0 release_sock+0x2b/0x90 sock_setsockopt+0x138/0x1140 ? __sys_getsockname+0x7e/0xc0 ? aa_sk_perm+0x3e/0x1a0 __sys_setsockopt+0x198/0x1e0 __x64_sys_setsockopt+0x21/0x30 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49372 is a Linux kernel networking bug in TCP Fast Open handling. Under specific timing conditions, the kernel can use a per-CPU statistics update from a context where preemption is allowed. The provided sources do not state business impact, CVSS, or confirmed exploitation.

Executive priority

Treat this as a kernel maintenance item unless vendor guidance raises severity. There is no sourced evidence of active exploitation or severe impact, but exposed Linux servers should receive normal security kernel updates after compatibility testing.

Technical view

The bug occurs when tcp_rtx_synack() is reached from process context while processing a passive Fast Open socket backlog after release_sock(). The fix replaces statistics updates that assume non-preemptible context with TCP_INC_STATS() and NET_INC_STATS(). Evidence points to a correctness/preemption issue, not a documented privilege escalation or remote code execution.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or commits, particularly kernels built with CONFIG_DEBUG_PREEMPT and using passive TCP Fast Open. The affected version data in the bundle is incomplete and should be validated against the distribution’s kernel package advisory.

Exploitation context

The source describes a reproducible kernel warning path involving TCP Fast Open, socket backlog processing, and SYN retransmission timing. KEV is false, and the provided sources do not claim active exploitation, public exploit code, or weaponized use.

Researcher notes

The trigger path requires passive Fast Open socket state, a user-owned socket during lock_sock()/release_sock(), backlog processing, and tcp_rtx_synack() called from process context. The source bundle lacks CVSS, CWE, exploitability assessment, and distribution-specific fixed package mapping.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check distribution advisories for the exact fixed kernel package.
  • Inventory hosts using TCP Fast Open or debug-preempt kernels.
  • Prioritize internet-facing Linux servers after vendor exposure confirmation.
  • Avoid direct wrangler or deployment actions unrelated to kernel remediation.

Validation and detection

  • Compare running kernel versions against vendor fixed-package guidance.
  • Confirm whether CONFIG_DEBUG_PREEMPT is enabled on candidate systems.
  • Check whether passive TCP Fast Open is enabled or used.
  • Review kernel logs for matching preemption warning signatures.
  • Verify patched kernels include the relevant stable commit for their branch.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49372 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef, 168a8f58059a22feb9e9a2dcc1b8053dbbbc12efunaffected
LinuxLinux3.7, 0, 4.9.318, 4.14.283, 4.19.247, 5.4.198, 5.10.122, 5.15.47, 5.17.15, 5.18.4, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.