CVE-2022-49651: srcu: Tighten cleanup_srcu_struct() GP checks

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: srcu: Tighten cleanup_srcu_struct() GP checks Currently, cleanup_srcu_struct() checks for a grace period in progress, but it does not check for a grace period that has not yet started but which might start at any time. Such a situation could result in a use-after-free bug, so this commit adds a check for a grace period that is needed but not yet started to cleanup_srcu_struct().

Affected products

Linux kernel: before 5.18.11 — fixed in 5.18.11

How to fix

Upgrade to a fixed version: Linux kernel 5.18.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49651 or the next vulnerability affects your stack