GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49888 (GCVE-0-2022-49888)

Vulnerability from cvelistv5 – Published: 2025-05-01 14:10 – Updated: 2026-05-11 19:08
VLAI
Title
arm64: entry: avoid kprobe recursion
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: entry: avoid kprobe recursion The cortex_a76_erratum_1463225_debug_handler() function is called when handling debug exceptions (and synchronous exceptions from BRK instructions), and so is called when a probed function executes. If the compiler does not inline cortex_a76_erratum_1463225_debug_handler(), it can be probed. If cortex_a76_erratum_1463225_debug_handler() is probed, any debug exception or software breakpoint exception will result in recursive exceptions leading to a stack overflow. This can be triggered with the ftrace multiple_probes selftest, and as per the example splat below. This is a regression caused by commit: 6459b8469753e9fe ("arm64: entry: consolidate Cortex-A76 erratum 1463225 workaround") ... which removed the NOKPROBE_SYMBOL() annotation associated with the function. My intent was that cortex_a76_erratum_1463225_debug_handler() would be inlined into its caller, el1_dbg(), which is marked noinstr and cannot be probed. Mark cortex_a76_erratum_1463225_debug_handler() as __always_inline to ensure this. Example splat prior to this patch (with recursive entries elided): | # echo p cortex_a76_erratum_1463225_debug_handler > /sys/kernel/debug/tracing/kprobe_events | # echo p do_el0_svc >> /sys/kernel/debug/tracing/kprobe_events | # echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable | Insufficient stack space to handle exception! | ESR: 0x0000000096000047 -- DABT (current EL) | FAR: 0xffff800009cefff0 | Task stack: [0xffff800009cf0000..0xffff800009cf4000] | IRQ stack: [0xffff800008000000..0xffff800008004000] | Overflow stack: [0xffff00007fbc00f0..0xffff00007fbc10f0] | CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2 | Hardware name: linux,dummy-virt (DT) | pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : arm64_enter_el1_dbg+0x4/0x20 | lr : el1_dbg+0x24/0x5c | sp : ffff800009cf0000 | x29: ffff800009cf0000 x28: ffff000002c74740 x27: 0000000000000000 | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 | x23: 00000000604003c5 x22: ffff80000801745c x21: 0000aaaac95ac068 | x20: 00000000f2000004 x19: ffff800009cf0040 x18: 0000000000000000 | x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 | x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 | x11: 0000000000000010 x10: ffff800008c87190 x9 : ffff800008ca00d0 | x8 : 000000000000003c x7 : 0000000000000000 x6 : 0000000000000000 | x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000043a4 | x2 : 00000000f2000004 x1 : 00000000f2000004 x0 : ffff800009cf0040 | Kernel panic - not syncing: kernel stack overflow | CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0xe4/0x104 | show_stack+0x18/0x4c | dump_stack_lvl+0x64/0x7c | dump_stack+0x18/0x38 | panic+0x14c/0x338 | test_taint+0x0/0x2c | panic_bad_stack+0x104/0x118 | handle_bad_stack+0x34/0x48 | __bad_stack+0x78/0x7c | arm64_enter_el1_dbg+0x4/0x20 | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 ... | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 ... | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | do_el0_svc+0x0/0x28 | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x18c/0x190 | Kernel Offset: disabled | CPU features: 0x0080,00005021,19001080 | Memory Limit: none | ---[ end Kernel panic - not syncing: kernel stack overflow ]--- With this patch, cortex_a76_erratum_1463225_debug_handler() is inlined into el1_dbg(), and el1_dbg() cannot be probed: | # echo p cortex_a76_erratum_1463225_debug_handler > /sys/kernel/debug/tracing/kprobe_events | sh: write error: No such file or directory | # grep -w cortex_a76_errat ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6459b8469753e9feaa8b34691d097cffad905931 , < 71d6c33fe223255f4416a01514da2c0bc3e283e7 (git)
Affected: 6459b8469753e9feaa8b34691d097cffad905931 , < db66629d43b2d12cb43b004a4ca6be1d03228e97 (git)
Affected: 6459b8469753e9feaa8b34691d097cffad905931 , < 024f4b2e1f874934943eb2d3d288ebc52c79f55c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.78 , ≤ 5.15.* (semver)
Unaffected: 6.0.8 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/entry-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "71d6c33fe223255f4416a01514da2c0bc3e283e7",
              "status": "affected",
              "version": "6459b8469753e9feaa8b34691d097cffad905931",
              "versionType": "git"
            },
            {
              "lessThan": "db66629d43b2d12cb43b004a4ca6be1d03228e97",
              "status": "affected",
              "version": "6459b8469753e9feaa8b34691d097cffad905931",
              "versionType": "git"
            },
            {
              "lessThan": "024f4b2e1f874934943eb2d3d288ebc52c79f55c",
              "status": "affected",
              "version": "6459b8469753e9feaa8b34691d097cffad905931",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/entry-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.78",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.8",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: avoid kprobe recursion\n\nThe cortex_a76_erratum_1463225_debug_handler() function is called when\nhandling debug exceptions (and synchronous exceptions from BRK\ninstructions), and so is called when a probed function executes. If the\ncompiler does not inline cortex_a76_erratum_1463225_debug_handler(), it\ncan be probed.\n\nIf cortex_a76_erratum_1463225_debug_handler() is probed, any debug\nexception or software breakpoint exception will result in recursive\nexceptions leading to a stack overflow. This can be triggered with the\nftrace multiple_probes selftest, and as per the example splat below.\n\nThis is a regression caused by commit:\n\n  6459b8469753e9fe (\"arm64: entry: consolidate Cortex-A76 erratum 1463225 workaround\")\n\n... which removed the NOKPROBE_SYMBOL() annotation associated with the\nfunction.\n\nMy intent was that cortex_a76_erratum_1463225_debug_handler() would be\ninlined into its caller, el1_dbg(), which is marked noinstr and cannot\nbe probed. Mark cortex_a76_erratum_1463225_debug_handler() as\n__always_inline to ensure this.\n\nExample splat prior to this patch (with recursive entries elided):\n\n| # echo p cortex_a76_erratum_1463225_debug_handler \u003e /sys/kernel/debug/tracing/kprobe_events\n| # echo p do_el0_svc \u003e\u003e /sys/kernel/debug/tracing/kprobe_events\n| # echo 1 \u003e /sys/kernel/debug/tracing/events/kprobes/enable\n| Insufficient stack space to handle exception!\n| ESR: 0x0000000096000047 -- DABT (current EL)\n| FAR: 0xffff800009cefff0\n| Task stack:     [0xffff800009cf0000..0xffff800009cf4000]\n| IRQ stack:      [0xffff800008000000..0xffff800008004000]\n| Overflow stack: [0xffff00007fbc00f0..0xffff00007fbc10f0]\n| CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2\n| Hardware name: linux,dummy-virt (DT)\n| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : arm64_enter_el1_dbg+0x4/0x20\n| lr : el1_dbg+0x24/0x5c\n| sp : ffff800009cf0000\n| x29: ffff800009cf0000 x28: ffff000002c74740 x27: 0000000000000000\n| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n| x23: 00000000604003c5 x22: ffff80000801745c x21: 0000aaaac95ac068\n| x20: 00000000f2000004 x19: ffff800009cf0040 x18: 0000000000000000\n| x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n| x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n| x11: 0000000000000010 x10: ffff800008c87190 x9 : ffff800008ca00d0\n| x8 : 000000000000003c x7 : 0000000000000000 x6 : 0000000000000000\n| x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000043a4\n| x2 : 00000000f2000004 x1 : 00000000f2000004 x0 : ffff800009cf0040\n| Kernel panic - not syncing: kernel stack overflow\n| CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2\n| Hardware name: linux,dummy-virt (DT)\n| Call trace:\n|  dump_backtrace+0xe4/0x104\n|  show_stack+0x18/0x4c\n|  dump_stack_lvl+0x64/0x7c\n|  dump_stack+0x18/0x38\n|  panic+0x14c/0x338\n|  test_taint+0x0/0x2c\n|  panic_bad_stack+0x104/0x118\n|  handle_bad_stack+0x34/0x48\n|  __bad_stack+0x78/0x7c\n|  arm64_enter_el1_dbg+0x4/0x20\n|  el1h_64_sync_handler+0x40/0x98\n|  el1h_64_sync+0x64/0x68\n|  cortex_a76_erratum_1463225_debug_handler+0x0/0x34\n...\n|  el1h_64_sync_handler+0x40/0x98\n|  el1h_64_sync+0x64/0x68\n|  cortex_a76_erratum_1463225_debug_handler+0x0/0x34\n...\n|  el1h_64_sync_handler+0x40/0x98\n|  el1h_64_sync+0x64/0x68\n|  cortex_a76_erratum_1463225_debug_handler+0x0/0x34\n|  el1h_64_sync_handler+0x40/0x98\n|  el1h_64_sync+0x64/0x68\n|  do_el0_svc+0x0/0x28\n|  el0t_64_sync_handler+0x84/0xf0\n|  el0t_64_sync+0x18c/0x190\n| Kernel Offset: disabled\n| CPU features: 0x0080,00005021,19001080\n| Memory Limit: none\n| ---[ end Kernel panic - not syncing: kernel stack overflow ]---\n\nWith this patch, cortex_a76_erratum_1463225_debug_handler() is inlined\ninto el1_dbg(), and el1_dbg() cannot be probed:\n\n| # echo p cortex_a76_erratum_1463225_debug_handler \u003e /sys/kernel/debug/tracing/kprobe_events\n| sh: write error: No such file or directory\n| # grep -w cortex_a76_errat\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:08:40.959Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/71d6c33fe223255f4416a01514da2c0bc3e283e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/db66629d43b2d12cb43b004a4ca6be1d03228e97"
        },
        {
          "url": "https://git.kernel.org/stable/c/024f4b2e1f874934943eb2d3d288ebc52c79f55c"
        }
      ],
      "title": "arm64: entry: avoid kprobe recursion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49888",
    "datePublished": "2025-05-01T14:10:33.183Z",
    "dateReserved": "2025-05-01T14:05:17.242Z",
    "dateUpdated": "2026-05-11T19:08:40.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49888",
      "date": "2026-09-16",
      "epss": "0.00241",
      "percentile": "0.15378"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49888\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:13.790\",\"lastModified\":\"2026-06-17T05:19:25.723\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: entry: avoid kprobe recursion\\n\\nThe cortex_a76_erratum_1463225_debug_handler() function is called when\\nhandling debug exceptions (and synchronous exceptions from BRK\\ninstructions), and so is called when a probed function executes. If the\\ncompiler does not inline cortex_a76_erratum_1463225_debug_handler(), it\\ncan be probed.\\n\\nIf cortex_a76_erratum_1463225_debug_handler() is probed, any debug\\nexception or software breakpoint exception will result in recursive\\nexceptions leading to a stack overflow. This can be triggered with the\\nftrace multiple_probes selftest, and as per the example splat below.\\n\\nThis is a regression caused by commit:\\n\\n  6459b8469753e9fe (\\\"arm64: entry: consolidate Cortex-A76 erratum 1463225 workaround\\\")\\n\\n... which removed the NOKPROBE_SYMBOL() annotation associated with the\\nfunction.\\n\\nMy intent was that cortex_a76_erratum_1463225_debug_handler() would be\\ninlined into its caller, el1_dbg(), which is marked noinstr and cannot\\nbe probed. Mark cortex_a76_erratum_1463225_debug_handler() as\\n__always_inline to ensure this.\\n\\nExample splat prior to this patch (with recursive entries elided):\\n\\n| # echo p cortex_a76_erratum_1463225_debug_handler \u003e /sys/kernel/debug/tracing/kprobe_events\\n| # echo p do_el0_svc \u003e\u003e /sys/kernel/debug/tracing/kprobe_events\\n| # echo 1 \u003e /sys/kernel/debug/tracing/events/kprobes/enable\\n| Insufficient stack space to handle exception!\\n| ESR: 0x0000000096000047 -- DABT (current EL)\\n| FAR: 0xffff800009cefff0\\n| Task stack:     [0xffff800009cf0000..0xffff800009cf4000]\\n| IRQ stack:      [0xffff800008000000..0xffff800008004000]\\n| Overflow stack: [0xffff00007fbc00f0..0xffff00007fbc10f0]\\n| CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2\\n| Hardware name: linux,dummy-virt (DT)\\n| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\\n| pc : arm64_enter_el1_dbg+0x4/0x20\\n| lr : el1_dbg+0x24/0x5c\\n| sp : ffff800009cf0000\\n| x29: ffff800009cf0000 x28: ffff000002c74740 x27: 0000000000000000\\n| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\\n| x23: 00000000604003c5 x22: ffff80000801745c x21: 0000aaaac95ac068\\n| x20: 00000000f2000004 x19: ffff800009cf0040 x18: 0000000000000000\\n| x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\\n| x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n| x11: 0000000000000010 x10: ffff800008c87190 x9 : ffff800008ca00d0\\n| x8 : 000000000000003c x7 : 0000000000000000 x6 : 0000000000000000\\n| x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000043a4\\n| x2 : 00000000f2000004 x1 : 00000000f2000004 x0 : ffff800009cf0040\\n| Kernel panic - not syncing: kernel stack overflow\\n| CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2\\n| Hardware name: linux,dummy-virt (DT)\\n| Call trace:\\n|  dump_backtrace+0xe4/0x104\\n|  show_stack+0x18/0x4c\\n|  dump_stack_lvl+0x64/0x7c\\n|  dump_stack+0x18/0x38\\n|  panic+0x14c/0x338\\n|  test_taint+0x0/0x2c\\n|  panic_bad_stack+0x104/0x118\\n|  handle_bad_stack+0x34/0x48\\n|  __bad_stack+0x78/0x7c\\n|  arm64_enter_el1_dbg+0x4/0x20\\n|  el1h_64_sync_handler+0x40/0x98\\n|  el1h_64_sync+0x64/0x68\\n|  cortex_a76_erratum_1463225_debug_handler+0x0/0x34\\n...\\n|  el1h_64_sync_handler+0x40/0x98\\n|  el1h_64_sync+0x64/0x68\\n|  cortex_a76_erratum_1463225_debug_handler+0x0/0x34\\n...\\n|  el1h_64_sync_handler+0x40/0x98\\n|  el1h_64_sync+0x64/0x68\\n|  cortex_a76_erratum_1463225_debug_handler+0x0/0x34\\n|  el1h_64_sync_handler+0x40/0x98\\n|  el1h_64_sync+0x64/0x68\\n|  do_el0_svc+0x0/0x28\\n|  el0t_64_sync_handler+0x84/0xf0\\n|  el0t_64_sync+0x18c/0x190\\n| Kernel Offset: disabled\\n| CPU features: 0x0080,00005021,19001080\\n| Memory Limit: none\\n| ---[ end Kernel panic - not syncing: kernel stack overflow ]---\\n\\nWith this patch, cortex_a76_erratum_1463225_debug_handler() is inlined\\ninto el1_dbg(), and el1_dbg() cannot be probed:\\n\\n| # echo p cortex_a76_erratum_1463225_debug_handler \u003e /sys/kernel/debug/tracing/kprobe_events\\n| sh: write error: No such file or directory\\n| # grep -w cortex_a76_errat\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: entrada: evitar la recursi\u00f3n de kprobe. La funci\u00f3n cortex_a76_erratum_1463225_debug_handler() se llama al gestionar excepciones de depuraci\u00f3n (y excepciones s\u00edncronas de instrucciones BRK), y por lo tanto se llama cuando se ejecuta una funci\u00f3n sondeada. Si el compilador no inserta en l\u00ednea cortex_a76_erratum_1463225_debug_handler(), se puede sondear. Si se sondea cortex_a76_erratum_1463225_debug_handler(), cualquier excepci\u00f3n de depuraci\u00f3n o excepci\u00f3n de punto de interrupci\u00f3n de software resultar\u00e1 en excepciones recursivas que conducen a un desbordamiento de pila. Esto se puede activar con la autoprueba ftrace multiple_probes y como se muestra en el ejemplo a continuaci\u00f3n. Esta es una regresi\u00f3n causada por el commit 6459b8469753e9fe (\\\"arm64: entry: consolidate Cortex-A76 erratum 1463225 workaround\\\"), que elimin\u00f3 la anotaci\u00f3n NOKPROBE_SYMBOL() asociada a la funci\u00f3n. Mi intenci\u00f3n era que cortex_a76_erratum_1463225_debug_handler() would be inlined into its caller, el1_dbg(), which is marked noinstr and cannot be probed. Mark cortex_a76_erratum_1463225_debug_handler() as __always_inline to ensure this. Example splat prior to this patch (with recursive entries elided): | # echo p cortex_a76_erratum_1463225_debug_handler \u0026gt; /sys/kernel/debug/tracing/kprobe_events | # echo p do_el0_svc \u0026gt;\u0026gt; /sys/kernel/debug/tracing/kprobe_events | # echo 1 \u0026gt; /sys/kernel/debug/tracing/events/kprobes/enable | Insufficient stack space to handle exception! | ESR: 0x0000000096000047 -- DABT (current EL) | FAR: 0xffff800009cefff0 | Task stack: [0xffff800009cf0000..0xffff800009cf4000] | IRQ stack: [0xffff800008000000..0xffff800008004000] | Overflow stack: [0xffff00007fbc00f0..0xffff00007fbc10f0] | CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2 | Hardware name: linux,dummy-virt (DT) | pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : arm64_enter_el1_dbg+0x4/0x20 | lr : el1_dbg+0x24/0x5c | sp : ffff800009cf0000 | x29: ffff800009cf0000 x28: ffff000002c74740 x27: 0000000000000000 | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 | x23: 00000000604003c5 x22: ffff80000801745c x21: 0000aaaac95ac068 | x20: 00000000f2000004 x19: ffff800009cf0040 x18: 0000000000000000 | x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 | x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 | x11: 0000000000000010 x10: ffff800008c87190 x9 : ffff800008ca00d0 | x8 : 000000000000003c x7 : 0000000000000000 x6 : 0000000000000000 | x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000000043a4 | x2 : 00000000f2000004 x1 : 00000000f2000004 x0 : ffff800009cf0040 | Kernel panic - not syncing: kernel stack overflow | CPU: 0 PID: 145 Comm: sh Not tainted 6.0.0 #2 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0xe4/0x104 | show_stack+0x18/0x4c | dump_stack_lvl+0x64/0x7c | dump_stack+0x18/0x38 | panic+0x14c/0x338 | test_taint+0x0/0x2c | panic_bad_stack+0x104/0x118 | handle_bad_stack+0x34/0x48 | __bad_stack+0x78/0x7c | arm64_enter_el1_dbg+0x4/0x20 | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 ... | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 ... | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | cortex_a76_erratum_1463225_debug_handler+0x0/0x34 | el1h_64_sync_handler+0x40/0x98 | el1h_64_sync+0x64/0x68 | do_el0_svc+0x0/0x28 | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x18c/0x190 | Kernel Offset: disabled | CPU features: 0x0080,00005021,19001080 | Memory Limit: none | ---[ end Kernel panic - not syncing: kernel stack overflow ]--- With this patch, cortex_a76_erratum_1463225_debug_handler() is inlined into el1_dbg(), and el1_dbg() cannot be probed: | # echo p cortex_a76_erratum_1463225_debug_handler \u0026gt; /sys/kernel/debug/tracing/kprobe_events | sh: write error: No such file or directory | # grep -w cortex_a76_errat ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kernel/entry-common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6459b8469753e9feaa8b34691d097cffad905931\",\"lessThan\":\"71d6c33fe223255f4416a01514da2c0bc3e283e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6459b8469753e9feaa8b34691d097cffad905931\",\"lessThan\":\"db66629d43b2d12cb43b004a4ca6be1d03228e97\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6459b8469753e9feaa8b34691d097cffad905931\",\"lessThan\":\"024f4b2e1f874934943eb2d3d288ebc52c79f55c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kernel/entry-common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.78\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.8\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.78\",\"matchCriteriaId\":\"047D3644-B2CA-4427-B14E-7F2ADE40217B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.8\",\"matchCriteriaId\":\"EC9A754E-625D-42F3-87A7-960D643E2867\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/024f4b2e1f874934943eb2d3d288ebc52c79f55c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/71d6c33fe223255f4416a01514da2c0bc3e283e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db66629d43b2d12cb43b004a4ca6be1d03228e97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:38:12+00:00",
      "cve": "CVE-2022-49888",
      "id": "CVE-2022-49888",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64: entry: avoid kprobe recursion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49888.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:52:55Z",
      "cve": "CVE-2022-49888",
      "id": "CVE-2022-49888",
      "initial_release_date": "2025-05-09T04:54:36Z",
      "product_status:known_affected": "339",
      "product_status:known_not_affected": "384",
      "product_status:recommended": "214",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49888",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49888.json",
      "version": "40"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.