Back
CVE-2022-48671
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
Medium5.5EPSS 0.18%
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
Affected products
- affected e446300968c6bd25d9cd6c33b9600780a39b3975 – < 321488cfac7d0eb6d97de467015ff754f85813ff
- affected 59c6902a96b4439e07c25ef86a4593bea5481c3b – < 07191f984842d50020789ff14c75da436a7f46a9
- affected dee1e2b18cf5426eed985512ccc6636ec69dbdd6 – < 9f267393b036f1470fb12fb892d59e7ff8aeb58d
- affected 3bf4bf54069f9b62a54988e5d085023c17a66c90 – < 5db17805b6ba4c34dab303f49aea3562fc25af75
- affected c0deb027c99c099aa6b831e326bfba802b25e774 – < 99bc25748e394d17f9e8b10cc7f273b8e64c1c7e
- affected 4f7e7236435ca0abe005c674ebd6892c6e83aeb3 – < 43626dade36fa74d3329046f4ae2d7fdefe401c6
- affected 5.4.213 – < 5.4.215
- affected 5.10.143 – < 5.10.145
- affected 5.15.68 – < 5.15.70
- affected 5.19.9 – < 5.19.11
References (6)
- https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7e (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-48671)Record last updated .