CVE-2022-49973: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49973 is a NULL pointer dereference vulnerability in the Linux kernel's skmsg (socket message) handling subsystem, specifically in the sk_msg_recvmsg() function. The flaw stems from an incorrect last scatter-gather (sg) list check introduced by a prior fix (commit 9974d37ea75f), which broke the sockmap redirection path that does not use stream_parser/stream_verdict/skb_verdict. Affected kernel versions include 5.15.61–5.15.66, 5.18.18–5.19, 5.19.2–5.19.8, and 6.0-rc1 through 6.0-rc3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in sk_msg_recvmsg() within the Linux kernel's BPF sockmap path. A prior commit changed the end-of-scatterlist check to use sg_is_last(), but functions such as sk_msg_alloc(), sk_msg_page_add(), and bpf_msg_push_data() do not mark the end of the scatterlist in the conventional way — they rely on sg.end for boundary judgment. In the sockmap redirection case (without stream_parser/stream_verdict/skb_verdict), this causes a kernel NULL pointer dereference during __tcp_bpf_recvmsg() when processing received socket messages. The fix restores the (i != msg_rx->sg.end) boundary check. Exploitation requires local access with low privileges to trigger the faulty code path (Feedly, Kernel Patch).

Successful exploitation allows a local, low-privileged attacker to trigger a kernel NULL pointer dereference, potentially causing a kernel panic or system crash, resulting in a denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems using BPF sockmap redirection without stream_parser/stream_verdict/skb_verdict are specifically at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting very low likelihood of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Feedly).

Kernel patches are available via the official Linux stable tree. Users should update to kernel versions 5.15.66 or later (for the 5.15.x branch), 5.19.8 or later (for the 5.19.x branch), or a stable release beyond 6.0-rc3. Patches are available at the official kernel git repository. Distribution-specific updates (e.g., from Red Hat, Ubuntu, Debian) should be applied as they become available. As a workaround, limiting local user access and avoiding BPF sockmap configurations without stream_parser/stream_verdict/skb_verdict can reduce exposure (Kernel Patch, Feedly).