{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49990", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.386Z", "datePublished": "2025-06-18T11:00:51.035Z", "dateUpdated": "2026-08-05T08:57:02.228Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:02.228Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390: fix double free of GS and RI CBs on fork() failure\n\nThe pointers for guarded storage and runtime instrumentation control\nblocks are stored in the thread_struct of the associated task. These\npointers are initially copied on fork() via arch_dup_task_struct()\nand then cleared via copy_thread() before fork() returns. If fork()\nhappens to fail after the initial task dup and before copy_thread(),\nthe newly allocated task and associated thread_struct memory are\nfreed via free_task() -> arch_release_task_struct(). This results in\na double free of the guarded storage and runtime info structs\nbecause the fields in the failed task still refer to memory\nassociated with the source task.\n\nThis problem can manifest as a BUG_ON() in set_freepointer() (with\nCONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled)\nwhen running trinity syscall fuzz tests on s390x. To avoid this\nproblem, clear the associated pointer fields in\narch_dup_task_struct() immediately after the new task is copied.\nNote that the RI flag is still cleared in copy_thread() because it\nresides in thread stack memory and that is where stack info is\ncopied." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local syscalls: s390_guarded_storage or s390_runtime_instr to allocate CBs, then fork/clone to hit the failure path that frees the parent's heap objects.\nAC:L - An attacker fully controls the setup and can reliably force fork failure after dup_task_struct (e.g. by lowering RLIMIT_NPROC), with no conditions outside attacker influence.\nPR:L - The GS/RI syscalls and fork are available to unprivileged users with no capability checks; only CPU facility presence is required on s390.\nUI:N - The attacker triggers the bug entirely via their own syscalls; no victim action is required.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same host kernel authority, not a cross-boundary VM/IOMMU escape.\nC:H - The parent's gs_cb/ri_cb become dangling after free_task kfree's them while still referenced on context switch, enabling classic heap UAF read primitives.\nI:H - Double-free/UAF of kmalloc'd control blocks allows heap reuse and write primitives suitable for control-flow hijacking or arbitrary kernel writes.\nA:H - The double free reliably causes BUG_ON in set_freepointer (with freelist hardening), KASAN splats, or kernel oops/panic on subsequent use or exit." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/s390/kernel/process.c" ], "versions": [ { "version": "8d9047f8b967ce6181fd824ae922978e1b055cc0", "lessThan": "25a95303b9e513cd2978aacc385d06e6fec23d07", "status": "affected", "versionType": "git" }, { "version": "8d9047f8b967ce6181fd824ae922978e1b055cc0", "lessThan": "cacd522e6652fbc2dc0cc6ae11c4e30782fef14b", "status": "affected", "versionType": "git" }, { "version": "8d9047f8b967ce6181fd824ae922978e1b055cc0", "lessThan": "297ae7e87a87a001dd3dfeac1cb26a42fd929708", "status": "affected", "versionType": "git" }, { "version": "8d9047f8b967ce6181fd824ae922978e1b055cc0", "lessThan": "8195e065abf3df84eb0ad2987e76a40f21d1791c", "status": "affected", "versionType": "git" }, { "version": "8d9047f8b967ce6181fd824ae922978e1b055cc0", "lessThan": "fbdc482d43eda40a70de4b0155843d5472f6de62", "status": "affected", "versionType": "git" }, { "version": "8d9047f8b967ce6181fd824ae922978e1b055cc0", "lessThan": "13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9", "status": "affected", "versionType": "git" }, { "version": "9e51ee1b76efc7b5e9404010793a39fde0e03cb7", "status": "affected", "versionType": "git" }, { "version": "232b47b3c88af1da737cd7760f247c4ed58168cf", "status": "affected", "versionType": "git" }, { "version": "b8e212c599082896a180a18a0c9bd529526590be", "status": "affected", "versionType": "git" }, { "version": "4.4.105", "lessThan": "4.5", "status": "affected", "versionType": "semver" }, { "version": "4.9.68", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.5", "lessThan": "4.15", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/s390/kernel/process.c" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.257", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.212", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.140", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.64", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.6", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "4.19.257" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.4.212" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.0" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.68" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.5" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/25a95303b9e513cd2978aacc385d06e6fec23d07" }, { "url": "https://git.kernel.org/stable/c/cacd522e6652fbc2dc0cc6ae11c4e30782fef14b" }, { "url": "https://git.kernel.org/stable/c/297ae7e87a87a001dd3dfeac1cb26a42fd929708" }, { "url": "https://git.kernel.org/stable/c/8195e065abf3df84eb0ad2987e76a40f21d1791c" }, { "url": "https://git.kernel.org/stable/c/fbdc482d43eda40a70de4b0155843d5472f6de62" }, { "url": "https://git.kernel.org/stable/c/13cccafe0edcd03bf1c841de8ab8a1c8e34f77d9" } ], "title": "s390: fix double free of GS and RI CBs on fork() failure", "x_generator": { "engine": "bippy-1.2.0" } } } }