{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"c6e8a7a1780af3da65e78a615f7d0874da6aabb0","status":"affected","version":"9e798e9aa14c45fb94e47b30bf6347b369ce9df7","versionType":"git"},{"lessThan":"36b038791e1e2baea892e9276588815fd14894b4","status":"affected","version":"9e798e9aa14c45fb94e47b30bf6347b369ce9df7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2022-49783","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Drop fpregs lock before inheriting FPU permissions\n\nMike Galbraith reported the following against an old fork of preempt-rt\nbut the same issue also applies to the current preempt-rt tree.\n\n   BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46\n   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: systemd\n   preempt_count: 1, expected: 0\n   RCU nest depth: 0, expected: 0\n   Preemption disabled at:\n   fpu_clone\n   CPU: 6 PID: 1 Comm: systemd Tainted: G            E       (unreleased)\n   Call Trace:\n    <TASK>\n    dump_stack_lvl\n    ? fpu_clone\n    __might_resched\n    rt_spin_lock\n    fpu_clone\n    ? copy_thread\n    ? copy_process\n    ? shmem_alloc_inode\n    ? kmem_cache_alloc\n    ? kernel_clone\n    ? __do_sys_clone\n    ? do_syscall_64\n    ? __x64_sys_rt_sigprocmask\n    ? syscall_exit_to_user_mode\n    ? do_syscall_64\n    ? syscall_exit_to_user_mode\n    ? do_syscall_64\n    ? syscall_exit_to_user_mode\n    ? do_syscall_64\n    ? exc_page_fault\n    ? entry_SYSCALL_64_after_hwframe\n    </TASK>\n\nMike says:\n\n  The splat comes from fpu_inherit_perms() being called under fpregs_lock(),\n  and us reaching the spin_lock_irq() therein due to fpu_state_size_dynamic()\n  returning true despite static key __fpu_state_size_dynamic having never\n  been enabled.\n\nMike's assessment looks correct. fpregs_lock on a PREEMPT_RT kernel disables\npreemption so calling spin_lock_irq() in fpu_inherit_perms() is unsafe. This\nproblem exists since commit\n\n  9e798e9aa14c (\"x86/fpu: Prepare fpu_clone() for dynamically enabled features\").\n\nEven though the original bug report should not have enabled the paths at\nall, the bug still exists.\n\nfpregs_lock is necessary when editing the FPU registers or a task's FP\nstate but it is not necessary for fpu_inherit_perms(). The only write\nof any FP state in fpu_inherit_perms() is for the new child which is\nnot running yet and cannot context switch or be borrowed by a kernel\nthread yet. Hence, fpregs_lock is not protecting anything in the new\nchild until clone() completes and can be dropped earlier. The siglock\nstill needs to be acquired by fpu_inherit_perms() as the read of the\nparent's permissions has to be serialised.\n\n  [ bp: Cleanup splat. ]","epss":{"date":"2026-11-05","percentile":0.06471,"score":0.0017},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793908188263,"publishedAt":1746108557054,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/c6e8a7a1780af3da65e78a615f7d0874da6aabb0"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/36b038791e1e2baea892e9276588815fd14894b4"}],"remediation":[],"revision":"6e49e02c24ae9cf3c33782cdddd6f5f47ce8f8b7d43852e9564d5073b2ef0024","sources":[{"modifiedAt":1793908188263,"name":"CNA: Linux","retrievedAt":1793909419328,"url":"https://www.cve.org/CVERecord?id=CVE-2022-49783"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793909456710,"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-49783"}],"ssvc":{"assessedAt":1793908068628,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"x86/fpu: Drop fpregs lock before inheriting FPU permissions","updatedAt":1793909456710}