On this page (7 sections)
Three Linux kernel vulnerabilities, CVE-2022-49082, CVE-2022-49149 and CVE-2022-49170, were published in the National Vulnerability Database on 2025-02-26. They affect three unrelated kernel components: the mpt3sas storage driver, the rxrpc network protocol and the f2fs file system.
If you administer Linux servers that host websites, especially shared or multi-user hosts, this article explains what the records say, where they disagree, and how to check and update your kernel. Our sources do not say which distribution releases or kernel versions are affected or fixed, so the steps below rely on your vendor's own security notice.
What the three CVEs are
Each CVE is a separate bug in kernel code that the Linux kernel project describes as resolved. They fall into different weakness classes, which helps when judging urgency.
| CVE | Component | Weakness | Plain-terms meaning |
|---|---|---|---|
| CVE-2022-49082 | scsi: mpt3sas (storage driver) | CWE-416 Use After Free | Code reads memory that was already released. The described case is a logging call when the driver module is removed |
| CVE-2022-49149 | rxrpc (network protocol) | CWE-362 Race Condition | A timer can be restarted while its call is being destroyed, and the timer code may later oops |
| CVE-2022-49170 | f2fs (file system) | CWE-129 Improper Validation of Array Index | A missing sanity check lets an array index go out of range, seen when mounting and operating a corrupted image |
Technical details and how serious they are
According to the GitHub advisory for CVE-2022-49082, a port structure is freed and then read by a later logging call. The fix stores the port ID in a local variable first. The advisory's CVSS v3 vector is local attack, low complexity, low privileges, no user interaction, with high impact on confidentiality, integrity and availability (7.8).
The advisory for CVE-2022-49170 describes a missing check on curseg->alloc_type that leads to out-of-bounds access on an array. It has the same 7.8 score and local vector. The reporter saw it on a corrupted file system image, so exposure depends on whether a host mounts untrusted f2fs images.
CVE-2022-49149 needs care because the sources disagree. The NVD-derived CVE data in our research gives a CVSS of 9.8 (critical). The GitHub advisory lists 4.7 (moderate), with a local vector, high attack complexity and impact on availability only. The description says the timer code may oops if the timer was deallocated first. Since the GitHub vector has availability impact only, a stability or service-disruption concern is a reasonable reading, but that is our inference, not a statement from the sources. We cannot say which score better reflects real-world risk, so rely on your vendor's priority rating.
Who is realistically exposed
- Servers that use the mpt3sas storage driver, the rxrpc protocol or the f2fs file system, since each bug lives in that specific code.
- Shared or multi-user hosts, because the GitHub CVSS vectors for all three describe a local attack with low privileges required.
- Hosting providers and agencies running web workloads, where a local foothold such as a compromised site account could be paired with a kernel bug. This is a general risk scenario, not something the sources report for these CVEs.
Based on the CVSS vectors in the GitHub advisories, these are not remote, unauthenticated web flaws. Their main risk to a website is as a second step after someone already has access to the server.
How to check your exposure
This read-only command prints the running kernel version. Compare it with the fixed version in your distribution's security notice.
uname -rThis lists installed kernel image packages so you can see whether a newer kernel is installed but not yet booted. Look for versions higher than the one from uname -r.
dpkg -l 'linux-image*' | grep ^iiThis checks whether the relevant modules are currently loaded. No output means none of the three is loaded on that host.
lsmod | grep -E 'mpt3sas|rxrpc|f2fs'What to do now
0 of 7 done
This refreshes package lists and upgrades installed packages on Debian or Ubuntu, including the kernel if a fixed version is available in your configured repositories.
sudo apt update && sudo apt upgradeDetection and monitoring afterwards
Bugs of this kind can surface as kernel errors or crashes. After updating, this command searches the kernel log for messages from the affected components. Repeated hits deserve investigation.
sudo dmesg | grep -iE 'mpt3sas|rxrpc|f2fs|KASAN|UBSAN'Because local kernel flaws matter most after a site is already compromised, watch the web layer too. Webforta Scan runs read-only security scans of sites you verify, and Webforta Monitor tracks uptime, certificate and DNS changes. Neither replaces patching the kernel. If you suspect someone else accessed a server, follow our guide on what to do when a website is hacked.
What we could not confirm
- Which distribution releases and kernel versions are affected or fixed.
- The contents of the upstream patch commits, which we could not read.
- Any in-the-wild exploitation. None is reported in the records we reviewed and the CISA KEV field is empty for all three, but that does not prove no exploitation exists.
- Which CVSS score for CVE-2022-49149 is the better guide to risk.
- Any link between these CVEs and a specific vendor notice, including any Ubuntu notice. Our sources do not mention one.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.