What is CVE-2022-3566?

CVE-2022-3566 is a High severity Linux kernel vulnerability with a CVSS score of 7.1 out of 10, classified as a Race Condition flaw (CWE-362), affecting Linux kernel versions from 4.19.316 onward and patched in 4.19.317, 5.4.279, 5.10.221 and others. CVE-2022-3566 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2022-3566?

CVE-2022-3566 has a CVSS score of 7.1 out of 10, rated High severity. The vector string is CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2022-3566?

Yes, CVE-2022-3566 has been patched. Fixed versions include 4.19.317, 5.4.279, 5.10.221 and others. If you are running Linux kernel 4.19.316 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2022-3566 actively exploited?

CVE-2022-3566 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Race Condition (CWE-362)?

The product contains a code sequence that can run concurrently with other code, creating unexpected states. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/362.html

CVE-2022-3566

High

A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated with this attack. The exploitability is said to be difficult. The vulnerability was introduced in 2.6.12, commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2"). Upgrading to version 4.19.317, 5.4.279, 5.10.221, 5.15.162 and 6.1 will fix this issue. The name of the patch is fcd31dd8291b23d713245947ec2b2d99ef07aef2/3b32f265805a49071e2c4568a524398ba22bf93c/d529193eae979a7bf2255cd9fe68b7af7a1c91b3/5bb642cc3355ffd3c8bca0a8bd8e6e65bcc2091c/f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57. The affected component should be upgraded.

Package Linux Kernel

Published 2022-10-17

Last modified 2026-08-26

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.1

out of 10

High

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-362

CVE-2022-3566 is a Race Condition vulnerability

What is Race Condition?

The product contains a code sequence that can run concurrently with other code, creating unexpected states. Learn more on MITRE CWE

Affected versions

Linux kernel versions 4.19.316, 5.4.278, 5.10.220, 5.15.161 and later are affected. Fixed in 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1 and their respective stable series.

Affected from

≥ 4.19.316 ≥ 5.4.278 ≥ 5.10.220 ≥ 5.15.161

Fixed in

✓ 4.19.317 ✓ 5.4.279 ✓ 5.10.221 ✓ 5.15.162 ✓ 6.1

References

6 total

Kernel Git
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57

Patch Third Party Advisory Vendor Advisory
Vuldb
https://vuldb.com/cve/CVE-2022-3566

Third Party Advisory VDB Entry
Vuldb
https://vuldb.com/vuln/211089

Third Party Advisory VDB Entry
Vuldb
https://vuldb.com/vuln/211089/cti

Permissions Required VDB Entry
Kernel.org
https://www.kernel.org/

Product

Showing 5 of 6 references View all on NVD

Details

CVE ID CVE-2022-3566

Severity High

CVSS score 7.1 / 10

CVSS version 3.1

Published 2022-10-17

Modified 2026-08-26

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2022-3566?

CVE-2022-3566 is a High severity Linux kernel vulnerability with a CVSS score of 7.1 out of 10 , classified as a Race Condition flaw (CWE-362) . It affects Linux kernel versions from 4.19.316 onward and has been patched in 4.19.317, 5.4.279, 5.10.221 and others. CVE-2022-3566 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2022-3566?

CVE-2022-3566 has a CVSS score of 7.1 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2022-3566?

Yes. CVE-2022-3566 has been patched. Fixed versions include 4.19.317, 5.4.279, 5.10.221 and others. If you are running Linux kernel 4.19.316 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2022-3566 actively exploited?

No. CVE-2022-3566 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.