{
  "cveId": "CVE-2022-49450",
  "url": "https://patchblox.com/security/cve/CVE-2022-49450",
  "summary": "CVE-2022-49450 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49450, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix listen() setting the bar too high for...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix listen() setting the bar too high for the prealloc rings  AF_RXRPC\u0027s listen() handler lets you set the backlog up to 32 (if you bump up the sysctl), but whilst the preallocation circular buffers have 32 slots in them, one of them has to be a dead slot because we\u0027re using CIRC_CNT().  This means that listen(rxrpc_sock, 32) will cause an oops when the socket is closed because rxrpc_service_prealloc_one() allocated one too many calls and rxrpc_discard_prealloc() won\u0027t then be able to get rid of them because it\u0027ll think the ring is empty.  rxrpc_release_calls_on_socket() then tries to abort them, but oopses because call-\u003Epeer isn\u0027t yet set.  Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match the ring capacity.   BUG: kernel NULL pointer dereference, address: 0000000000000086  ...  RIP: 0010:rxrpc_send_abort_packet\u002B0x73/0x240 [rxrpc]  Call Trace:   \u003CTASK\u003E   ? __wake_up_common_lock\u002B0x7a/0x90   ? rxrpc_notify_socket\u002B0x8e/0x140 [rxrpc]   ? rxrpc_abort_call\u002B0x4c/0x60 [rxrpc]   rxrpc_release_calls_on_socket\u002B0x107/0x1a0 [rxrpc]   rxrpc_release\u002B0xc9/0x1c0 [rxrpc]   __sock_release\u002B0x37/0xa0   sock_close\u002B0x11/0x20   __fput\u002B0x89/0x240   task_work_run\u002B0x59/0x90   do_exit\u002B0x319/0xaa0",
  "published": "2025-02-26T07:01:21Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00291,
  "epssPercentile": 0.21754,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49450",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49450",
      "released": "2025-02-26T07:01:21Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49450",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49450",
      "released": "2025-02-26T07:01:21Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49450",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49450",
      "released": "2025-02-26T07:01:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}