LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup()

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix WARNING in ip_vs_app_net_cleanup() During the initialization of ip_vs_app_net_init(), if file ip_vs_app fails to be created, the initialization is successful by default. Therefore, the ip_vs_app file doesn't be found during the remove in ip_vs_app_net_cleanup(). It will cause WRNING. The following is the stack information: name 'ip_vs_app' WARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP: 0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects IPVS cleanup behavior. If creation of the ip_vs_app proc entry fails during initialization, later namespace cleanup can try to remove a missing entry and trigger a kernel warning. The sources describe a warning condition, not data theft, privilege escalation, or remote compromise.

Executive priority

Handle through normal kernel patch management unless your environment relies heavily on IPVS load balancing. There is no source evidence of active exploitation or severe impact, but kernel fixes should still be tracked because reliability issues in networking components can affect operations.

Technical view

CVE-2022-49917 is in the Linux kernel IP Virtual Server code. ip_vs_app_net_init() could treat proc entry creation failure as successful, leaving ip_vs_app absent. ip_vs_app_net_cleanup() then attempted removal and hit remove_proc_entry() warning during net namespace cleanup. Stable kernel commits are listed as fixes.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel ranges where IPVS code is present or enabled. The bundle lists Linux as affected from 2.6.24 through several stable lines before fixed releases. Distribution backports may change practical exposure.

Exploitation context

The provided sources do not report active exploitation, KEV listing, exploit code, CVSS score, or a demonstrated security impact beyond a kernel warning. Treat exploitation status as unconfirmed and do not assume this is remotely exploitable.

Researcher notes

The key failure path is proc entry creation failure in ip_vs_app_net_init() followed by cleanup in ip_vs_app_net_cleanup(). The CVE data lacks CVSS, CWE, and exploitability analysis, so risk assessment should stay conservative and tied to kernel version, IPVS usage, and distro backport status.

Mitigation direction

  • Update to a vendor-supported kernel containing the listed stable fixes.
  • Check Linux distribution advisories for backported fixes and package-specific version mapping.
  • Prioritize internet-facing load-balancing hosts that use IPVS or related kernel modules.
  • If immediate patching is delayed, monitor vendor guidance for temporary mitigations.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Confirm whether affected hosts use IPVS or related load-balancing functionality.
  • Map installed kernels to vendor advisories or the listed stable commits.
  • Review kernel logs for recurring ip_vs_app or remove_proc_entry warnings.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49917 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux457c4cbc5a3dde259d2a1f15d5f9785290397267, 457c4cbc5a3dde259d2a1f15d5f9785290397267, 457c4cbc5a3dde259d2a1f15d5f9785290397267, 457c4cbc5a3dde259d2a1f15d5f9785290397267, 457c4cbc5a3dde259d2a1f15d5f9785290397267, 457c4cbc5a3dde259d2a1f15d5f9785290397267unaffected
LinuxLinux2.6.24, 0, 4.19.265, 5.4.224, 5.10.154, 5.15.78, 6.0.8, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.