What is the CVSS score of CVE-2022-49127?

CVE-2022-49127 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2022-49127?

A kernel integrity vulnerability in Linux systems (CVE-2022-49127) could allow users with local access to trigger memory corruption and destabilize production systems, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2022-49127?

Within 24 hours, identify all production and non-production Linux systems running vulnerable kernels by querying patch management systems and asset inventory; prioritize systems with high local-user density or exposed local access channels. Within 7 days, contact your Linux distribution vendor (Red Hat, Canonical, SUSE, etc.) or kernel maintainer to obtain the specific patched kernel version for your supported distribution and kernel series, then test the update in isolated non-production environments matching your production configuration. Within 30 days, deploy the patched kernel across all affected systems using your standard change management process, scheduling updates during maintenance windows and performing standard kernel patching validations.

Linux Kernel CVE-2022-49127

HIGH

Use After Free (CWE-416)

2025-02-26 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Use After Free Memory Corruption

High

Disputed · 7.0 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Low–High)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local race condition during kernel netdevice teardown requires low-privilege access and precise timing (AC:H); full kernel memory impact justifies C/I/A:H with no scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 10:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 10:56 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 10:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 10:23 NVD

7.8 (HIGH) 7.0 (HIGH)

Analysis Generated

Mar 28, 2026 - 18:28 vuln.today

Patch released

Mar 28, 2026 - 18:28 nvd

Patch available

CVE Published

Feb 26, 2025 - 07:00 nvd

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ref_tracker: implement use-after-free detection

Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir as dead.

Test the dead status from ref_tracker_alloc() and ref_tracker_free()

This should detect buggy dev_put()/dev_hold() happening too late in netdevice dismantle process.

AnalysisAI

Use-after-free in the Linux kernel's ref_tracker subsystem exposes local low-privilege users to full kernel memory corruption during netdevice teardown. The flaw exists because ref_tracker_alloc() and ref_tracker_free() do not validate the dead status of a struct ref_tracker_dir after ref_tracker_dir_init() marks it as destroyed, allowing dev_put()/dev_hold() operations that fire too late in the netdevice dismantle sequence to access logically-freed memory. No public exploit exists and EPSS at 0.05% (14th percentile) confirms negligible real-world exploitation activity; active exploitation is not confirmed in CISA KEV.

Technical ContextAI

The ref_tracker subsystem (net/core) manages reference counting for Linux network devices. A struct ref_tracker_dir acts as a tracking directory: upon teardown ref_tracker_dir_init() is expected to mark it dead, but neither ref_tracker_alloc() nor ref_tracker_free() validated that dead flag before the fix, constituting a classic CWE-416 Use-After-Free. The race arises in the netdevice dismantle path where reference operations (dev_hold/dev_put) can execute against an already logically-destroyed tracking structure. The CPE (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) covers the kernel broadly with no version bounds specified in NVD data, suggesting the flaw predates the fix commits without a confirmed first-affected version.

RemediationAI

Apply the upstream kernel patches available at https://git.kernel.org/stable/c/3743c9de303fa36c2e2ca2522ab280c52bcafbd2 and https://git.kernel.org/stable/c/e3ececfe668facd87d920b608349a32607060e66, which implement dead-status validation in ref_tracker_alloc() and ref_tracker_free(). Downstream Linux distributions (Red Hat, Ubuntu, SUSE, Debian) will backport these to their stable kernel packages; update to the latest available kernel from your vendor. No exact patched release version is independently confirmed from provided references - verify against your distribution's security advisories. As a compensating control where immediate patching is not feasible, restrict CAP_NET_ADMIN capability via seccomp profiles or LSM (SELinux/AppArmor) policies to prevent unprivileged users from triggering network device lifecycle operations; note this does not eliminate the flaw but substantially reduces the exploitable attack surface.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed

CVE-2022-49127 vulnerability details – vuln.today

Back

Linux Kernel CVE-2022-49127

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code