CVE-2022-49090

arch/arm64: Fix topology initialization for core scheduling

MEDIUM
5.5
CVSS Score
Published: February 26, 2025 at 01:54 AM UTC
Updated: June 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: arch/arm64: Fix topology initialization for core scheduling Arm64 systems rely on store_cpu_topology() to call update_siblings_masks() to transfer the toplogy to the various cpu masks. This needs to be done before the call to notify_cpu_starting() which tells the scheduler about each cpu found, otherwise the core scheduling data structures are setup in a way that does not match the actual topology. With smt_mask not setup correctly we bail on `cpumask_weight(smt_mask) == 1` for !leaders in: notify_cpu_starting() cpuhp_invoke_callback_range() sched_cpu_starting() sched_core_cpu_starting() which leads to rq->core not being correctly set for !leader-rq's. Without this change stress-ng (which enables core scheduling in its prctl tests in newer versions -- i.e. with PR_SCHED_CORE support) causes a warning and then a crash (trimmed for legibility): [ 1853.805168] ------------[ cut here ]------------ [ 1853.809784] task_rq(b)->core != rq->core [ 1853.809792] WARNING: CPU: 117 PID: 0 at kernel/sched/fair.c:11102 cfs_prio_less+0x1b4/0x1c4 ... [ 1854.015210] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... [ 1854.231256] Call trace: [ 1854.233689] pick_next_task+0x3dc/0x81c [ 1854.237512] __schedule+0x10c/0x4cc [ 1854.240988] schedule_idle+0x34/0x54

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.14 ≤ v < 5.15.345.14 ≤ v < 5.16.205.14 ≤ v < 5.17.35.14 ≤ v < 5.185.16 ≤ v < 5.16.205.17 ≤ v < 5.17.35.145.18 rc19edeaea1bc452372718837ed2ba775811baf1ba1
Vendor states this is fixed in 5524cbb1bfcdff0cad0aaa9f94e6092002a07259 (fixed)
Vendor states this is fixed in 790c1567582bda8f1153015436e3330a7c6eb278 (fixed)
Vendor states this is fixed in 87f5d66daa5f457449bb95d6b8d18bb7596aa627 (fixed)
Vendor states this is fixed in c78a1b2d0bff678570c8dc9f14035606f5e5257d (fixed)
Vendor states this is fixed in 5.14 (unaffected)
Vendor states this is fixed in 5.15.34 (unaffected)
Vendor states this is fixed in 5.16.20 (unaffected)
Vendor states this is fixed in 5.17.3 (unaffected)
Vendor states this is fixed in 5.18 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5524cbb1bfcdff0cad0aaa9f94e6092002a07259
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/790c1567582bda8f1153015436e3330a7c6eb278
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/87f5d66daa5f457449bb95d6b8d18bb7596aa627
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c78a1b2d0bff678570c8dc9f14035606f5e5257d

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card