PT-2025-8018 · Linux+4 · Linux Kernel+4

Dietmar Eggemann + 1 · Published 2022-03-31 · Updated 2025-09-29 · CVE-2022-49090

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the initialization of topology for core scheduling on Arm64 systems. The issue arises when the store cpu topology() function fails to correctly set up the smt mask, leading to a mismatch between the actual topology and the core scheduling data structures. This can cause a warning and a crash, particularly when running stress-ng tests that enable core scheduling. The problem occurs because rq->core is not correctly set for non-leader CPUs, resulting in a NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

BDU:2025-06061

CVE-2022-49090

RHSA-2022:8267

RHSA-2022_8267

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Red Hat

Red Os

Suse

References · 1335

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49090.json · Exploit
• https://git.kernel.org/stable/c/790c1567582bda8f1153015436e3330a7c6eb278 · Patch
• https://git.kernel.org/stable/c/c78a1b2d0bff678570c8dc9f14035606f5e5257d · Patch
• https://bdu.fstec.ru/vul/2025-06061 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://git.kernel.org/stable/c/87f5d66daa5f457449bb95d6b8d18bb7596aa627 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49090 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49090 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49090 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49090 · Security Note