# CVE-2022-49198: linux: In the Linux kernel, the following vulnerability has been resolved:  mptcp: Fix crash due to tcp_tsorted_anchor was i...

CVE-2022-49198 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49198, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-49198
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0026
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 26, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb  Got crash when doing pressure test of mptcp:  =========================================================================== dst_release: dst:ffffa06ce6e5c058 refcnt:-1 kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle kernel paging request at ffffa06ce6e5c058 PGD 190a01067 P4D 190a01067 PUD 43fffb067 PMD 22e403063 PTE 8000000226e5c063 Oops: 0011 [#1] SMP PTI CPU: 7 PID: 7823 Comm: kworker/7:0 Kdump: loaded Tainted: G            E Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.2.1 04/01/2014 Call Trace:  ? skb_release_head_state+0x68/0x100  ? skb_release_all+0xe/0x30  ? kfree_skb+0x32/0xa0  ? mptcp_sendmsg_frag+0x57e/0x750  ? __mptcp_retrans+0x21b/0x3c0  ? __switch_to_asm+0x35/0x70  ? mptcp_worker+0x25e/0x320  ? process_one_work+0x1a7/0x360  ? worker_thread+0x30/0x390  ? create_worker+0x1a0/0x1a0  ? kthread+0x112/0x130  ? kthread_flush_work_fn+0x10/0x10  ? ret_from_fork+0x35/0x40 ===========================================================================  In __mptcp_alloc_tx_skb skb was allocated and skb->tcp_tsorted_anchor will be initialized, in under memory pressure situation sk_wmem_schedule will return false and then kfree_skb. In this case skb->_skb_refdst is not null because_skb_refdst and tcp_tsorted_anchor are stored in the same mem, and kfree_skb will try to release dst and cause crash.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.17.3-1 | [DEBIAN-CVE-2022-49198](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49198.md) | Feb 26, 2025 |
| Linux | linux Debian 13.5 (trixie) | 5.17.3-1 | [DEBIAN-CVE-2022-49198](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49198.md) | Feb 26, 2025 |
| Linux | linux Debian 14 | 5.17.3-1 | [DEBIAN-CVE-2022-49198](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49198.md) | Feb 26, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.