CVE-2022-49732: sock: redo the psock vs ULP protection check

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the new tcp_bpf_update_proto() function. I'm guessing that this was done to allow creating psocks for non-inet sockets. Unfortunately the destruction path for psock includes the ULP unwind, so we need to fail the sk_psock_init() itself. Otherwise if ULP is already present we'll notice that later, and call tcp_update_ulp() with the sk_proto of the ULP itself, which will most likely result in the ULP looping its callbacks.

Affected products

Linux kernel: from 5.13 before 5.15.51; from 5.16 before 5.18.8; 5.19-rc1, 5.19-rc2, 5.19-rc3 — fixed in 5.15.51, 5.18.8

How to fix

Upgrade to a fixed version: Linux kernel 5.15.51, 5.18.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49732 or the next vulnerability affects your stack