{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"8b08d4f97233d8e58fff2fd9d5f86397a49733c5","status":"affected","version":"b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5","versionType":"git"},{"lessThan":"91926d8b7e71aaf5f84f0cf208fc5a8b7a761050","status":"affected","version":"b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5","versionType":"git"},{"status":"affected","version":"5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d","versionType":"git"},{"status":"affected","version":"5f4367448f6817c8a0e94dc9736ed84fa8eee4a3","versionType":"git"},{"status":"affected","version":"c9c41f0273826a13ac93124e66a4ff45df281ba0","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.46","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.14","versionType":"semver"},{"lessThan":"5.19","status":"affected","version":"5.18.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.19.*","status":"unaffected","version":"5.19.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2022-49955","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Fix RTAS MSR[HV] handling for Cell\n\nThe semi-recent changes to MSR handling when entering RTAS (firmware)\ncause crashes on IBM Cell machines. An example trace:\n\n  kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0)\n  BUG: Unable to handle kernel instruction fetch\n  Faulting instruction address: 0x2fff01a8\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell\n  Modules linked in:\n  CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W          6.0.0-rc2-00433-gede0a8d3307a #207\n  NIP:  000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000\n  REGS: c0000000015236b0 TRAP: 0400   Tainted: G        W           (6.0.0-rc2-00433-gede0a8d3307a)\n  MSR:  0000000008001002 <ME,RI>  CR: 00000000  XER: 20000000\n  ...\n  NIP 0x2fff01a8\n  LR  0x32608\n  Call Trace:\n    0xc00000000143c5f8 (unreliable)\n    .rtas_call+0x224/0x320\n    .rtas_get_boot_time+0x70/0x150\n    .read_persistent_clock64+0x114/0x140\n    .read_persistent_wall_and_boot_offset+0x24/0x80\n    .timekeeping_init+0x40/0x29c\n    .start_kernel+0x674/0x8f0\n    start_here_common+0x1c/0x50\n\nUnlike PAPR platforms where RTAS is only used in guests, on the IBM Cell\nmachines Linux runs with MSR[HV] set but also uses RTAS, provided by\nSLOF.\n\nFix it by copying the MSR[HV] bit from the MSR value we've just read\nusing mfmsr into the value used for RTAS.\n\nIt seems like we could also fix it using an #ifdef CELL to set MSR[HV],\nbut that doesn't work because it's possible to build a single kernel\nimage that runs on both Cell native and pseries.","epss":{"date":"2026-11-05","percentile":0.11145,"score":0.00209},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793908812210,"publishedAt":1750244417617,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/8b08d4f97233d8e58fff2fd9d5f86397a49733c5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/91926d8b7e71aaf5f84f0cf208fc5a8b7a761050"}],"remediation":[],"revision":"62fb29b34a3edeb36e2903f53f1e689a16cece4e7ff4fa6759a7d45ee81d12fe","sources":[{"modifiedAt":1793908812210,"name":"CNA: Linux","retrievedAt":1793909486540,"url":"https://www.cve.org/CVERecord?id=CVE-2022-49955"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793909521369,"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-49955"}],"ssvc":{"assessedAt":1793908317598,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"powerpc/rtas: Fix RTAS MSR[HV] handling for Cell","updatedAt":1793909521369}