CVE-2022-49990: s390: fix double free of GS and RI CBs on fork() failure
In the Linux kernel, the following vulnerability has been resolved:
s390: fix double free of GS and RI CBs on fork() failure
The pointers for guarded storage and runtime instrumentation control
blocks are stored in the thread_struct of the associated task. These
pointers are initially copied on fork() via arch_dup_task_struct()
and then cleared via copy_thread() before fork() returns. If fork()
happens to fail after the initial task dup and before copy_thread(),
the newly allocated task and associated thread_struct memory are
freed via free_task() -> arch_release_task_struct(). This results in
a double free of the guarded storage and runtime info structs
because the fields in the failed task still refer to memory
associated with the source task.
This problem can manifest as a BUG_ON() in set_freepointer() (with
CONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled)
when running trinity syscall fuzz tests on s390x. To avoid this
problem, clear the associated pointer fields in
arch_dup_task_struct() immediately after the new task is copied.
Note that the RI flag is still cleared in copy_thread() because it
resides in thread stack memory and that is where stack info is
copied.
Security readout for executives and security teams
Plain-English summary
This is an s390x-specific Linux kernel double-free bug in a rare fork() failure path. It can crash hardened or instrumented kernels during stress testing, creating availability risk for IBM Z/Linux workloads. The bundle does not provide a CVSS score or evidence of real-world exploitation.
Executive priority
Treat as a targeted kernel reliability issue for s390x environments. It is not currently supported as internet-scale or actively exploited, but affected IBM Z/Linux production systems should be patched during the next appropriate maintenance window.
Technical view
On s390, arch_dup_task_struct() copied guarded storage and runtime instrumentation control block pointers into a new task. If fork() failed before copy_thread() cleared them, task teardown could free memory owned by the source task, causing a double free. The fix clears those copied pointers immediately after task duplication.
Likely exposure
Exposure appears limited to Linux kernels on s390/s390x systems with the affected kernel code. The source lists Linux kernel versions and stable commits, but distro package mappings are not included. Non-s390 architectures are not implicated by the provided description.
Exploitation context
The source describes discovery through trinity syscall fuzzing on s390x, with BUG_ON() or KASAN reports under hardening/instrumentation. KEV is false, and no provided source states active exploitation, public exploit availability, or remote attack paths.
Researcher notes
The evidence supports an architecture-specific kernel lifetime bug around copied thread_struct pointers during fork() error unwinding. Impact details are incomplete: no CVSS, CWE, privilege boundary, or exploitability assessment is provided. Avoid assuming more than local crash or memory corruption risk from the bundle.
Mitigation direction
Update affected s390/s390x Linux kernels using vendor or distro guidance.
Prioritize systems running IBM Z/Linux production workloads.
Check whether your kernel includes one of the referenced stable fixes.
Monitor vendor advisories for package-specific fixed versions.
Do not rely on disabling hardening as a remediation.
Validation and detection
Inventory Linux systems by architecture and kernel version.
Identify s390/s390x hosts using affected kernel lines or commits.
Confirm installed distro kernel contains the referenced fix.
Review kernel logs for double-free, BUG_ON, or KASAN reports.
Track remediation evidence through patch management records.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-49990 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
7Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Jun 18, 2025, 11:00 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.