LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49990: s390: fix double free of GS and RI CBs on fork() failure

In the Linux kernel, the following vulnerability has been resolved: s390: fix double free of GS and RI CBs on fork() failure The pointers for guarded storage and runtime instrumentation control blocks are stored in the thread_struct of the associated task. These pointers are initially copied on fork() via arch_dup_task_struct() and then cleared via copy_thread() before fork() returns. If fork() happens to fail after the initial task dup and before copy_thread(), the newly allocated task and associated thread_struct memory are freed via free_task() -> arch_release_task_struct(). This results in a double free of the guarded storage and runtime info structs because the fields in the failed task still refer to memory associated with the source task. This problem can manifest as a BUG_ON() in set_freepointer() (with CONFIG_SLAB_FREELIST_HARDENED enabled) or KASAN splat (if enabled) when running trinity syscall fuzz tests on s390x. To avoid this problem, clear the associated pointer fields in arch_dup_task_struct() immediately after the new task is copied. Note that the RI flag is still cleared in copy_thread() because it resides in thread stack memory and that is where stack info is copied.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is an s390x-specific Linux kernel double-free bug in a rare fork() failure path. It can crash hardened or instrumented kernels during stress testing, creating availability risk for IBM Z/Linux workloads. The bundle does not provide a CVSS score or evidence of real-world exploitation.

Executive priority

Treat as a targeted kernel reliability issue for s390x environments. It is not currently supported as internet-scale or actively exploited, but affected IBM Z/Linux production systems should be patched during the next appropriate maintenance window.

Technical view

On s390, arch_dup_task_struct() copied guarded storage and runtime instrumentation control block pointers into a new task. If fork() failed before copy_thread() cleared them, task teardown could free memory owned by the source task, causing a double free. The fix clears those copied pointers immediately after task duplication.

Likely exposure

Exposure appears limited to Linux kernels on s390/s390x systems with the affected kernel code. The source lists Linux kernel versions and stable commits, but distro package mappings are not included. Non-s390 architectures are not implicated by the provided description.

Exploitation context

The source describes discovery through trinity syscall fuzzing on s390x, with BUG_ON() or KASAN reports under hardening/instrumentation. KEV is false, and no provided source states active exploitation, public exploit availability, or remote attack paths.

Researcher notes

The evidence supports an architecture-specific kernel lifetime bug around copied thread_struct pointers during fork() error unwinding. Impact details are incomplete: no CVSS, CWE, privilege boundary, or exploitability assessment is provided. Avoid assuming more than local crash or memory corruption risk from the bundle.

Mitigation direction

  • Update affected s390/s390x Linux kernels using vendor or distro guidance.
  • Prioritize systems running IBM Z/Linux production workloads.
  • Check whether your kernel includes one of the referenced stable fixes.
  • Monitor vendor advisories for package-specific fixed versions.
  • Do not rely on disabling hardening as a remediation.

Validation and detection

  • Inventory Linux systems by architecture and kernel version.
  • Identify s390/s390x hosts using affected kernel lines or commits.
  • Confirm installed distro kernel contains the referenced fix.
  • Review kernel logs for double-free, BUG_ON, or KASAN reports.
  • Track remediation evidence through patch management records.
Prepared
Confidence
medium
Sources
8

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49990 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8d9047f8b967ce6181fd824ae922978e1b055cc0, 8d9047f8b967ce6181fd824ae922978e1b055cc0, 8d9047f8b967ce6181fd824ae922978e1b055cc0, 8d9047f8b967ce6181fd824ae922978e1b055cc0, 8d9047f8b967ce6181fd824ae922978e1b055cc0, 8d9047f8b967ce6181fd824ae922978e1b055cc0, 9e51ee1b76efc7b5e9404010793a39fde0e03cb7, 232b47b3c88af1da737cd7760f247c4ed58168cf, b8e212c599082896a180a18a0c9bd529526590beunaffected
LinuxLinux4.15, 0, 4.19.257, 5.4.212, 5.10.140, 5.15.64, 5.19.6, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.