CVE-2022-49356
A critical flaw in the Linux kernel’s SUNRPC RDMA code can let an attacker overflow a memory segment array, potentially leading to arbitrary code execution or a system crash. The issue has been fixed in the kernel, so updating to a patched version removes the risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running versions before the patch, notably those on kernel 5.19 or earlier. This includes system administrators, developers, and operators of Linux‑based servers and devices.
Real-world impact
An attacker could exploit the overflow to run code with kernel privileges, gaining full control of the system or causing a denial of service.
Why this severity
The CVSS score of 9.8 reflects that the flaw is network‑exploitable, requires no user interaction, and can compromise confidentiality, integrity, and availability entirely.
What to do about it
- 01Check your current kernel version.
- 02Update your system to a Linux kernel version that includes the patch (e.g., 5.19 or later).
- 03Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Feb 26, 2025 · Feb 26, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.