{"id":"CVE-2022-49783","title":"x86/fpu: Drop fpregs lock before inheriting FPU permissions","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Drop fpregs lock before inheriting FPU permissions\n\nMike Galbraith reported the following against an old fork of preempt-rt\nbut the same issue also applies to …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 9e798e9aa14c45fb94e47b30bf6347b369ce9df7 < c6e8a7a1780af3da65e78a615f7d0874da6aabb0","Linux >= 9e798e9aa14c45fb94e47b30bf6347b369ce9df7 < 36b038791e1e2baea892e9276588815fd14894b4","Linux 5.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:47:48.628453Z"},"published":"2025-05-01","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:49:48.263Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49783","references":[{"url":"https://git.kernel.org/stable/c/c6e8a7a1780af3da65e78a615f7d0874da6aabb0"},{"url":"https://git.kernel.org/stable/c/36b038791e1e2baea892e9276588815fd14894b4"}],"tags":["cve.org"],"epss":0.0017,"epssPercentile":0.06461,"ingestedAt":"2026-11-05T22:38:31.592Z","slug":"CVE-2022-49783","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Drop fpregs lock before inheriting FPU permissions\n\nMike Galbraith reported the following against an old fork of preempt-rt\nbut the same issue also applies to the current preempt-rt tree.\n\n   BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46\n   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: systemd\n   preempt_count: 1, expected: 0\n   RCU nest depth: 0, expected: 0\n   Preemption disabled at:\n   fpu_clone\n   CPU: 6 PID: 1 Comm: systemd Tainted: G            E       (unreleased)\n   Call Trace:\n    <TASK>\n    dump_stack_lvl\n    ? fpu_clone\n    __might_resched\n    rt_spin_lock\n    fpu_clone\n    ? copy_thread\n    ? copy_process\n    ? shmem_alloc_inode\n    ? kmem_cache_alloc\n    ? kernel_clone\n    ? __do_sys_clone\n    ? do_syscall_64\n    ? __x64_sys_rt_sigprocmask\n    ? syscall_exit_to_user_mode\n    ? do_syscall_64\n    ? syscall_exit_to_user_mode\n    ? do_syscall_64\n    ? syscall_exit_to_user_mode\n    ? do_syscall_64\n    ? exc_page_fault\n    ? entry_SYSCALL_64_after_hwframe\n    </TASK>\n\nMike says:\n\n  The splat comes from fpu_inherit_perms() being called under fpregs_lock(),\n  and us reaching the spin_lock_irq() therein due to fpu_state_size_dynamic()\n  returning true despite static key __fpu_state_size_dynamic having never\n  been enabled.\n\nMike's assessment looks correct. fpregs_lock on a PREEMPT_RT kernel disables\npreemption so calling spin_lock_irq() in fpu_inherit_perms() is unsafe. This\nproblem exists since commit\n\n  9e798e9aa14c (\"x86/fpu: Prepare fpu_clone() for dynamically enabled features\").\n\nEven though the original bug report should not have enabled the paths at\nall, the bug still exists.\n\nfpregs_lock is necessary when editing the FPU registers or a task's FP\nstate but it is not necessary for fpu_inherit_perms(). The only write\nof any FP state in fpu_inherit_perms() is for the new child which is\nnot running yet and cannot context switch or be borrowed by a kernel\nthread yet. Hence, fpregs_lock is not protecting anything in the new\nchild until clone() completes and can be dropped earlier. The siglock\nstill needs to be acquired by fpu_inherit_perms() as the read of the\nparent's permissions has to be serialised.\n\n  [ bp: Cleanup splat. ]\n\n## Affected\n\n- `Linux >= 9e798e9aa14c45fb94e47b30bf6347b369ce9df7 < c6e8a7a1780af3da65e78a615f7d0874da6aabb0`\n- `Linux >= 9e798e9aa14c45fb94e47b30bf6347b369ce9df7 < 36b038791e1e2baea892e9276588815fd14894b4`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}