CVE-2022-50771

Vulnerability

Analysis

CVE-2022-50771 is a bug in the Linux kernel's RCU (Read-Copy-Update) subsystem. The function rcu_force_quiescent_state() uses __this_cpu_read(), which is intended for non-preemptible code, but the function is called in preemptible context when the kernel is built with CONFIG_PREEMPTION=y. This mismatch triggers a lockdep splat as reported during rcutorture testing [1].

Attack

Vector

Triggering vulnerability requires configuring a kernel with CONFIG_PREEMPTION and running rcutorture a non-zero fqs_duration parameter. The perpetrator only require access to an rcutorture test session, which is typically only available to privileged users with access to kernel configuration and torture testing infrastructure [1]. No authentication or network access is required for exploitation beyond local access to kernel debugging tools.

Impact

The impact of this vulnerability is limited to a lockdep warning that does not cause data corruption or privilege escalation. However, it indicates a race condition that can produce undesired behavior. The warning itself disrupts logs and may trigger system instability under concurrent preemptible paths [1].

Mitigation

A patch replaces __this_cpu_read() with raw_cpu_read() to fix the warning. Patched versions are available from the stable kernel trees, and users are advised to update to kernels containing commit a74af9b937707b42c3fd041aae1ed4ce2f337307 or equivalent backports [2].