PT-2025-18521 · Linux+3 · Linux Kernel+3

Published 2022-11-16 · Updated 2025-05-13 · CVE-2022-49804

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel. The issue is related to the use of a global register for current stack pointer on the s390 architecture. This uncovered an old bug in gcc, which is fixed in versions 9.1 and later, as well as in 8.4 and later due to a backport. The bug causes gcc versions prior to 8.4 to generate broken code, leading to stack corruptions. The current minimum required gcc version to build the kernel is 5.1.

Recommendations To resolve the issue, avoid using the global register variable for current stack pointer. As a temporary workaround, consider avoiding the use of the current stack pointer global register variable until a patch is available.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2026-03978

CVE-2022-49804

RHSA-2025:6966

RHSA-2025_6966

Affected Products

Astra Linux

Linux Kernel

Red Hat

Gcc

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49804.json · Exploit
• https://git.kernel.org/stable/c/a478952a8ac44e32316dc046a063a7dc34825aa6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49804 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49804 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49804 · Security Note
• https://ubuntu.com/security/CVE-2022-49804 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03978 · Security Note
• https://git.kernel.org/stable/c/e3c11025bcd2142a61abe5806b2f86a0e78118df · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49804 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49804 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2025050127-CVE-2022-49804-0866@gregkh/T · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.10 · Note
• https://twitter.com/CVEnew/status/1918014627855716772 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note