PT-2025-8642 · Linux+1 · Linux Kernel+1

Sami Tolvanen · Published 2022-06-13 · Updated 2025-02-27 · CVE-2022-49709

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, related to the usage of RCU NONIDLE during the cfi slowpath diag function. This can result in an invalid RCU state in the cpuidle code path, leading to warnings and potential issues. The problem arises from the incorrect usage of RCU NONIDLE, which can cause the RCU state to become invalid when the cpuidle code path is executed. To address this, the solution involves calling rcu irq enter and rcu irq exit to wake up RCU only when necessary and disabling interrupts for the entire CFI shadow/module check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-371

Related Identifiers

BDU:2026-03883

CVE-2022-49709

Affected Products

Astra Linux

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49709.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49709 · Vendor Advisory
• https://git.kernel.org/stable/c/75f3a5fa2ad049c85ab5d5ee1ed9cfaa7e62c5ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49709 · Security Note
• https://ubuntu.com/security/CVE-2022-49709 · Vendor Advisory
• https://git.kernel.org/stable/c/ca3897f2ac02ceae5e6fa794f83c36f9885b93da · Patch
• https://git.kernel.org/stable/c/57cd6d157eb479f0a8e820fd36b7240845c8a937 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49709 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49709 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49709 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49709 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03883 · Security Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.6 · Note
• https://twitter.com/CVEnew/status/1894592807542702509 · Twitter Post
• https://git.kernel.org/linus/57cd6d157eb479f0a8e820fd36b7240845c8a937 · Note