CVE-2022-49998: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49998 affects the Linux kernel's rxrpc sendmsg implementation. The vulnerability was discovered in June 2025 and impacts the kernel's network protocol handling, specifically related to locking mechanisms in the rxrpc subsystem (NVD).

The vulnerability encompasses three distinct bugs in the rxrpc's sendmsg implementation: 1) rxrpc_new_client_call() failing to release the socket lock when returning an error from rxrpc_get_call_slot(), 2) rxrpc_wait_for_tx_window_intr() returning without the call mutex held during signal interruption, and 3) rxrpc_send_data() needing to recheck the tx_pending buffer and tx_total_len after dropping and regaining the call mutex (NVD, Wiz).

The vulnerability can lead to a bad unlock balance condition, potentially causing system instability. This is evidenced by warning messages indicating improper lock handling, which could result in system crashes or unpredictable behavior (NVD).

The vulnerability has been fixed in various Linux kernel versions. The fix includes modifications to the locking mechanism in rxrpc's sendmsg implementation. Debian has marked this as fixed in versions 5.10.223-1 for bullseye, 6.1.137-1 for bookworm, and 6.12.31-1 for trixie (Debian Tracker).