Security readout for executives and security teams
Plain-English summary
This is a Linux kernel powerpc issue affecting IBM Cell systems using RTAS firmware. A kernel change mishandled the hypervisor bit in the machine state register before RTAS calls, causing crashes. The public record does not show remote exploitation, data theft, privilege escalation, or broad cloud impact.
Executive priority
Low broad-enterprise urgency unless the organization operates IBM Cell or related powerpc Linux systems. For affected environments, treat as an availability and stability fix, with priority based on system criticality.
Technical view
On Cell, Linux can run with MSR[HV] set while still calling RTAS supplied by SLOF. A prior RTAS entry path failed to preserve that HV state, leading to bad instruction fetches and kernel oopses. The fix copies MSR[HV] from the current MSR into the RTAS MSR value.
Likely exposure
Exposure appears limited to Linux on IBM Cell or compatible powerpc systems using RTAS. Most x86, ARM, ordinary cloud, and non-Cell Linux deployments are not indicated as affected by the provided sources.
Exploitation context
CISA KEV is false, and the provided sources do not report active exploitation. The evidence describes crash behavior on specific hardware, not a public exploit chain or attacker workflow.
Researcher notes
The record lacks CVSS, CWE, exploit prerequisites, and detailed affected downstream packages. The clearest impact is a kernel crash from incorrect RTAS MSR[HV] handling on Cell. Avoid assuming confidentiality or privilege impact without additional vendor evidence.
Mitigation direction
- Identify any Linux powerpc Cell systems in asset inventory.
- Review kernel version and vendor advisories for CVE-2022-49955.
- Update to a kernel containing the referenced stable fixes.
- Prioritize affected production or availability-sensitive Cell systems.
- Monitor vendor guidance if using downstream Linux distributions.
Validation and detection
- Confirm whether any fleet systems run Linux on IBM Cell hardware.
- Check kernel package changelogs for CVE-2022-49955 or the stable commit IDs.
- Review boot and kernel logs for RTAS-related oopses on affected hardware.
- Verify patched systems boot and perform RTAS timekeeping paths normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-49955 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8b08d4f97233d8e58fff2fd9d5f86397a49733c5CVE reference, Linux
- https://git.kernel.org/stable/c/91926d8b7e71aaf5f84f0cf208fc5a8b7a761050CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.