CVE-2022-3977: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously calls DROPTAG ioctl and socket close happens, which could allow a local user to crash the system or potentially escalate their privileges on the system.

Affected products

• Linux Linux Kernel: from 5.18, before 5.19.16 (fixed in 5.19.16); from 6.0, before 6.0.2 (fixed in 6.0.2)

Published 2023-01-12. Last modified 2026-06-17.