PT-2025-8473 · Linux+1 · Linux Kernel+1

Published 2022-04-11 · Updated 2025-02-27 · CVE-2022-49540

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes this fix

Description A race condition in the Linux kernel's RCU Tasks Rude grace-period process has been identified. This issue occurs during early boot when there is only one online CPU, causing problems due to the rcu tasks rude wait gp() function's call to schedule on each cpu(). The purpose of RCU Tasks Rude is to force a schedule on each online CPU since some past event, but in the context of a single CPU, this is unnecessary. The issue results in a warning and a call trace, indicating a potential problem with the kernel's workqueue and scheduling mechanisms.

Recommendations For Linux kernel versions prior to the fixed version, apply the single-CPU optimization to the RCU Tasks Rude grace-period process to prevent the race condition from occurring. This can be achieved by modifying the rcu tasks rude wait gp() function to check if there is only one online CPU before calling schedule on each cpu(), and if so, skipping this call to avoid the problem.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-371

CWE-362

Related Identifiers

BDU:2026-01454

CVE-2022-49540

Affected Products

Astra Linux

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49540.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-49540 · Vendor Advisory
• https://git.kernel.org/stable/c/1c6c3f2336642fb3074593911f5176565f47ec41 · Patch
• https://git.kernel.org/stable/c/f75fd4b9221d93177c50dcfde671b2e907f53e86 · Patch
• https://git.kernel.org/stable/c/ba722d061bc4b54802d701fc63fc2fd988934603 · Patch
• https://git.kernel.org/stable/c/8f49a8758b5cd541bd7aa9a0d0d11c7426141c0e · Patch
• https://osv.dev/vulnerability/CVE-2022-49540 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49540 · Security Note
• https://git.kernel.org/stable/c/230bf5878af6038dfb63d9184272a58475236580 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49540 · Security Note
• https://bdu.fstec.ru/vul/2026-01454 · Security Note
• https://ubuntu.com/security/CVE-2022-49540 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49540 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49540 · Vendor Advisory
• https://twitter.com/CVEnew/status/1894895464870191409 · Twitter Post