CVE-2022-49193

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

ice: fix 'scheduling while atomic' on aux critical err interrupt

There's a kernel BUG splat on processing aux critical error interrupts in ice_misc_intr():

As Andrew correctly mentioned previously[0], the following call ladder happens:

Add a new PF state bit which indicates that an aux critical error occurred and serve it in ice_service_task() in process context. The new ice_pf::oicr_err_reg is read-write in both hardirq and process contexts, but only 3 bits of non-critical data probably aren't worth explicit synchronizing (and they're even in the same byte [31:24]).

Leer descripción completaMostrar menos

[0] https://lore.kernel.org/all/YeSRUVmrdmlUXHDn@lunn.ch

Detalles técnicos trazas, registros y código del informe original

[ 2100.917085] BUG: scheduling while atomic: swapper/15/0/0x00010000
...
[ 2101.060770] Call Trace:
[ 2101.063229]  <IRQ>
[ 2101.065252]  dump_stack+0x41/0x60
[ 2101.068587]  __schedule_bug.cold.100+0x4c/0x58
[ 2101.073060]  __schedule+0x6a4/0x830
[ 2101.076570]  schedule+0x35/0xa0
[ 2101.079727]  schedule_preempt_disabled+0xa/0x10
[ 2101.084284]  __mutex_lock.isra.7+0x310/0x420
[ 2101.088580]  ? ice_misc_intr+0x201/0x2e0 [ice]
[ 2101.093078]  ice_send_event_to_aux+0x25/0x70 [ice]
[ 2101.097921]  ice_misc_intr+0x220/0x2e0 [ice]
[ 2101.102232]  __handle_irq_event_percpu+0x40/0x180
[ 2101.106965]  handle_irq_event_percpu+0x30/0x80
[ 2101.111434]  handle_irq_event+0x36/0x53
[ 2101.115292]  handle_edge_irq+0x82/0x190
[ 2101.119148]  handle_irq+0x1c/0x30
[ 2101.122480]  do_IRQ+0x49/0xd0
[ 2101.125465]  common_interrupt+0xf/0xf
[ 2101.129146]  </IRQ>
...

ice_misc_intr() <- hardirq
  ice_send_event_to_aux()
    device_lock()
      mutex_lock()
        might_sleep()
          might_resched() <- oops

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 5.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.27%
Percentil entre todas las CVEs puntuadas: 17
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

NVD-CWE-noinfo

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-49193",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "348048e724a0e8f08b63948d728d27596f6d3769",
              "lessThan": "9b77c8cf69a41d1e3851370aeaa04a9ea83b865c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "348048e724a0e8f08b63948d728d27596f6d3769",
              "lessThan": "24d7ac8426306ae7ccea7f7dd612a7368fe7201d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "348048e724a0e8f08b63948d728d27596f6d3769",
              "lessThan": "59e88a50afad7469c55804e46bf2924b9130281f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "348048e724a0e8f08b63948d728d27596f6d3769",
              "lessThan": "32d53c0aa3a7b727243473949bad2a830b908edc",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver",
              "lessThanOrEqual": "5.16.*"
            },
            {
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.17.*"
            },
            {
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/intel/ice/ice.h",
            "drivers/net/ethernet/intel/ice/ice_main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:00:56.383",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24d7ac8426306ae7ccea7f7dd612a7368fe7201d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/32d53c0aa3a7b727243473949bad2a830b908edc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/59e88a50afad7469c55804e46bf2924b9130281f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9b77c8cf69a41d1e3851370aeaa04a9ea83b865c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix 'scheduling while atomic' on aux critical err interrupt\n\nThere's a kernel BUG splat on processing aux critical error\ninterrupts in ice_misc_intr():\n\n[ 2100.917085] BUG: scheduling while atomic: swapper/15/0/0x00010000\n...\n[ 2101.060770] Call Trace:\n[ 2101.063229]  <IRQ>\n[ 2101.065252]  dump_stack+0x41/0x60\n[ 2101.068587]  __schedule_bug.cold.100+0x4c/0x58\n[ 2101.073060]  __schedule+0x6a4/0x830\n[ 2101.076570]  schedule+0x35/0xa0\n[ 2101.079727]  schedule_preempt_disabled+0xa/0x10\n[ 2101.084284]  __mutex_lock.isra.7+0x310/0x420\n[ 2101.088580]  ? ice_misc_intr+0x201/0x2e0 [ice]\n[ 2101.093078]  ice_send_event_to_aux+0x25/0x70 [ice]\n[ 2101.097921]  ice_misc_intr+0x220/0x2e0 [ice]\n[ 2101.102232]  __handle_irq_event_percpu+0x40/0x180\n[ 2101.106965]  handle_irq_event_percpu+0x30/0x80\n[ 2101.111434]  handle_irq_event+0x36/0x53\n[ 2101.115292]  handle_edge_irq+0x82/0x190\n[ 2101.119148]  handle_irq+0x1c/0x30\n[ 2101.122480]  do_IRQ+0x49/0xd0\n[ 2101.125465]  common_interrupt+0xf/0xf\n[ 2101.129146]  </IRQ>\n...\n\nAs Andrew correctly mentioned previously[0], the following call\nladder happens:\n\nice_misc_intr() <- hardirq\n  ice_send_event_to_aux()\n    device_lock()\n      mutex_lock()\n        might_sleep()\n          might_resched() <- oops\n\nAdd a new PF state bit which indicates that an aux critical error\noccurred and serve it in ice_service_task() in process context.\nThe new ice_pf::oicr_err_reg is read-write in both hardirq and\nprocess contexts, but only 3 bits of non-critical data probably\naren't worth explicit synchronizing (and they're even in the same\nbyte [31:24]).\n\n[0] https://lore.kernel.org/all/YeSRUVmrdmlUXHDn@lunn.ch"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ice: fix 'scheduling while atomic' on aux critical err interrupción Hay un ERROR del kernel en el procesamiento de interrupciones de error crítico auxiliar en ice_misc_intr(): [ 2100.917085] ERROR: scheduling while atomic: swapper/15/0/0x00010000 ... [ 2101.060770] Seguimiento de llamadas: [ 2101.063229]  [ 2101.065252] dump_stack+0x41/0x60 [ 2101.068587] __schedule_bug.cold.100+0x4c/0x58 [ 2101.073060] __schedule+0x6a4/0x830 [ [2101.076570] schedule+0x35/0xa0 [2101.079727] schedule_preempt_disabled+0xa/0x10 [2101.084284] __mutex_lock.isra.7+0x310/0x420 [2101.088580] ? ice_misc_intr+0x201/0x2e0 [hielo] [ 2101.093078] ice_send_event_to_aux+0x25/0x70 [hielo] [ 2101.097921] ice_misc_intr+0x220/0x2e0 [hielo] [ 2101.102232] __handle_irq_event_percpu+0x40/0x180 [ 2101.106965] handle_irq_event_percpu+0x30/0x80 [ 2101.111434] handle_irq_event+0x36/0x53 [ 2101.115292] handle_edge_irq+0x82/0x190 [ 2101.119148] handle_irq+0x1c/0x30 [ 2101.122480] do_IRQ+0x49/0xd0 [ 2101.125465] common_interrupt+0xf/0xf [ 2101.129146]  ... Como Andrew mencionó correctamente anteriormente[0], ocurre la siguiente escalera de llamadas: ice_misc_intr() &lt;- hardirq ice_send_event_to_aux() device_lock() mutex_lock() might_sleep() might_resched() &lt;- oops Agregue un nuevo bit de estado de PF que indique que ocurrió un error crítico auxiliar y sirvalo en ice_service_task() en el contexto del proceso. El nuevo ice_pf::oicr_err_reg es de lectura y escritura tanto en contextos de hardirq como de proceso, pero solo 3 bits de datos no críticos probablemente no merezcan una sincronización explícita (e incluso están en el mismo byte [31:24]). [0] https://lore.kernel.org/all/YeSRUVmrdmlUXHDn@lunn.ch"
    }
  ],
  "lastModified": "2026-06-17T05:17:20.783",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB1C7FD1-C89E-4955-B265-456A9F757302",
              "versionEndExcluding": "5.15.33",
              "versionStartIncluding": "5.14"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20C43679-0439-405A-B97F-685BEE50613B",
              "versionEndExcluding": "5.16.19",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF",
              "versionEndExcluding": "5.17.2",
              "versionStartIncluding": "5.17"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}