Core Scheduling Initialization Flaw in Linux Kernel - CVE-2022-49090
Summary
CVE-2022-49090: In the Linux kernel, the following vulnerability has been resolved: arch/arm64: Fix topology initialization for core scheduling Arm64 systems rely on store_cpu_topology() to call update_siblings_masks() to transfer the t... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware resources and providing essential services to software applications. It supports various architectures, including Arm64, and is crucial for system stability and performance. The vulnerability CVE-2022-49090 arises from improper initialization of core scheduling topology, which can lead to system crashes under specific conditions.
Vulnerability Detail
CVE-2022-49090 is a vulnerability in the Linux kernel affecting Arm64 systems. It originates from the incorrect order of operations in the topology initialization process, specifically the failure to call update_siblings_masks() before notify_cpu_starting(). This oversight can cause the core scheduling data structures to be misconfigured, leading to a mismatch between the actual CPU topology and the scheduler's understanding of it. As a result, this can trigger warnings and potentially crash the system when stress-ng tests are run, particularly when core scheduling is enabled.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating the Linux kernel as described above.
Conclusion
CVE-2022-49090 is a critical vulnerability in the Linux kernel that affects core scheduling on Arm64 systems. It is essential for users to update their systems to the patched version to prevent potential crashes and ensure system stability. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49090 is a vulnerability in the Linux kernel that affects the initialization of core scheduling on Arm64 systems, potentially leading to system crashes.
You can use Vulert, which monitors open-source vulnerabilities in software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can cause system instability, leading to warnings and crashes during CPU scheduling operations, particularly under stress testing.
Yes, a patch is available in version 5.17.3-1 and later for Debian 12 and 13. Users should update their Linux kernel to this version or newer.
While there are no specific workarounds, it is recommended to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
