CVE-2022-49149

CVE-2022-49149 is a vulnerability in the Linux kernel's RxRPC (Remote Execution RPC) subsystem, which is used for remote procedure calls over the network. The issue stems from a race condition in the handling of call timers within the rxrpc_call structure. Specifically, when packet input routines operate in softirq mode with only a Read-Copy-Update (RCU) read lock held, a timer associated with a call can be started while the call is simultaneously being destroyed. This situation can lead to the timer being restarted after it has been deallocated, resulting in a null pointer dereference and potentially causing a system crash.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because triggering the flaw requires winning a narrow race condition during call termination and results solely in a denial of service (kernel oops) with no confidentiality or integrity compromise. In standard Red Hat deployments, the AF_RXRPC network protocol is not utilized unless in-kernel Andrew File System (AFS) functionality is specifically configured. Consequently, typical environments that do not process RxRPC traffic are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.