PT-2025-8380 · Linux+2 · Linux Kernel+2

Dan Williams + 1 · Published 2025-02-26 · Updated 2025-04-15 · CVE-2022-49446

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock scenario has been identified in the Linux kernel related to nvdimm (non-volatile dual in-line memory module) firmware activation. The issue arises from the locking mechanism used to protect against unregistration and simultaneous operations. Specifically, the nvdimm bus lock() is held over hibernate quiet exec(), which walks the system device topology and takes device lock() along the way. This can lead to a deadlock scenario involving the system transition mutex and reconfig mutex. Another deadlock scenario involves the acpi scan lock and cxl root key. The issue stems from redundant lock usage, which can be deleted to prevent the deadlock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2022-49446

OPENSUSE-SU-2025_1263-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1314

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49446.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:1263-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49446 · Vendor Advisory
• https://git.kernel.org/stable/c/e6829d1bd3c4b58296ee9e412f7ed4d6cb390192 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49446 · Vendor Advisory
• https://git.kernel.org/stable/c/ceb924ee16b2c8e48dcac3d9ad6be01c40b5a228 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49446 · Security Note
• https://ubuntu.com/security/CVE-2022-49446 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49446 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1194-1 · Vendor Advisory
• https://git.kernel.org/stable/c/2f97ebc58d5fc83ca1528cd553fa725472ab3ca8 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://git.kernel.org/stable/c/2fd853fdb40afc052de338693df1372f2ead7be7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49446 · Security Note