PT-2025-18499 · Linux+1 · Linux Kernel+1

Published 2022-11-08 · Updated 2025-05-02 · CVE-2022-49782

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc2-syzkaller-00073-g88619e77b33d

Description A vulnerability has been resolved in the Linux kernel related to missing SIGTRAP checking. The issue occurs when some events not associated with progress in the user space task can fire and the interrupt handler runs before the IRQ work meant to consume pending sigtrap. This can cause the kernel to re-enter and trigger a warning. The vulnerability was identified by syzbot, which produced a program with event type PERF TYPE SOFTWARE and config PERF COUNT SW CPU CLOCK. The hrtimer manages to fire again before the IRQ work got a chance to run, all while never having returned to user space. The warning has been improved to check for real progress in user space by storing a 32-bit hash of the current IP into pending sigtrap.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the missing SIGTRAP checking vulnerability. As a temporary workaround, consider disabling the perf event overflow() function until a patch is available. Restrict access to the vulnerable perf swevent hrtimer() function to minimize the risk of exploitation. Avoid using the pending sigtrap variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Stack Overflow

Weakness Enumeration

CWE-674

CWE-121

Related Identifiers

BDU:2026-03752

CVE-2022-49782

Affected Products

Astra Linux

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49782.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49782 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49782 · Vendor Advisory
• https://git.kernel.org/stable/c/b09221f1b4944d2866d06ac35e59d7a6f8916c9f · Patch
• https://ubuntu.com/security/CVE-2022-49782 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49782 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49782 · Vendor Advisory
• https://git.kernel.org/stable/c/35c60b4e8ca76712dd03bafe2598e31578248916 · Patch
• https://git.kernel.org/stable/c/bb88f9695460bec25aa30ba9072595025cf6c8af · Patch
• https://bdu.fstec.ru/vul/2026-03752 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49782 · Security Note
• https://twitter.com/CVEnew/status/1918014650286813359 · Twitter Post
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.10 · Note
• https://access.redhat.com/security/cve/cve-2022-49782 · Note