GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49759 (GCVE-0-2022-49759)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:43 – Updated: 2026-05-11 19:06
VLAI
Title
VMCI: Use threaded irqs instead of tasklets
Summary
In the Linux kernel, the following vulnerability has been resolved: VMCI: Use threaded irqs instead of tasklets The vmci_dispatch_dgs() tasklet function calls vmci_read_data() which uses wait_event() resulting in invalid sleep in an atomic context (and therefore potentially in a deadlock). Use threaded irqs to fix this issue and completely remove usage of tasklets. [ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145 [ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd [ 20.264645] preempt_count: 101, expected: 0 [ 20.264646] RCU nest depth: 0, expected: 0 [ 20.264647] 1 lock held by vmtoolsd/762: [ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock] [ 20.264658] Preemption disabled at: [ 20.264659] [<ffff80000151d7d8>] vmci_send_datagram+0x44/0xa0 [vmw_vmci] [ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1 [ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020 [ 20.264668] Call trace: [ 20.264669] dump_backtrace+0xc4/0x130 [ 20.264672] show_stack+0x24/0x80 [ 20.264673] dump_stack_lvl+0x88/0xb4 [ 20.264676] dump_stack+0x18/0x34 [ 20.264677] __might_resched+0x1a0/0x280 [ 20.264679] __might_sleep+0x58/0x90 [ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci] [ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci] [ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150 [ 20.264688] tasklet_action+0x40/0x50 [ 20.264689] __do_softirq+0x23c/0x6b4 [ 20.264690] __irq_exit_rcu+0x104/0x214 [ 20.264691] irq_exit_rcu+0x1c/0x50 [ 20.264693] el1_interrupt+0x38/0x6c [ 20.264695] el1h_64_irq_handler+0x18/0x24 [ 20.264696] el1h_64_irq+0x68/0x6c [ 20.264697] preempt_count_sub+0xa4/0xe0 [ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0 [ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci] [ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci] [ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci] [ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport] [ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport] [ 20.264713] vsock_connect+0x278/0x330 [vsock] [ 20.264715] __sys_connect_file+0x8c/0xc0 [ 20.264718] __sys_connect+0x84/0xb4 [ 20.264720] __arm64_sys_connect+0x2c/0x3c [ 20.264721] invoke_syscall+0x78/0x100 [ 20.264723] el0_svc_common.constprop.0+0x68/0x124 [ 20.264724] do_el0_svc+0x38/0x4c [ 20.264725] el0_svc+0x60/0x180 [ 20.264726] el0t_64_sync_handler+0x11c/0x150 [ 20.264728] el0t_64_sync+0x190/0x194
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 17:22 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 463713eb6164b6577f8e91447c7745628215531b , < 548ea9dd5e01b0ecf53d2563004c80abd636743d (git)
Affected: 463713eb6164b6577f8e91447c7745628215531b , < 3daed6345d5880464f46adab871d208e1baa2f3a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.8 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:22:23.073608Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:22:26.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_vmci/vmci_guest.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "548ea9dd5e01b0ecf53d2563004c80abd636743d",
              "status": "affected",
              "version": "463713eb6164b6577f8e91447c7745628215531b",
              "versionType": "git"
            },
            {
              "lessThan": "3daed6345d5880464f46adab871d208e1baa2f3a",
              "status": "affected",
              "version": "463713eb6164b6577f8e91447c7745628215531b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/vmw_vmci/vmci_guest.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: Use threaded irqs instead of tasklets\n\nThe vmci_dispatch_dgs() tasklet function calls vmci_read_data()\nwhich uses wait_event() resulting in invalid sleep in an atomic\ncontext (and therefore potentially in a deadlock).\n\nUse threaded irqs to fix this issue and completely remove usage\nof tasklets.\n\n[   20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145\n[   20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd\n[   20.264645] preempt_count: 101, expected: 0\n[   20.264646] RCU nest depth: 0, expected: 0\n[   20.264647] 1 lock held by vmtoolsd/762:\n[   20.264648]  #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock]\n[   20.264658] Preemption disabled at:\n[   20.264659] [\u003cffff80000151d7d8\u003e] vmci_send_datagram+0x44/0xa0 [vmw_vmci]\n[   20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1\n[   20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020\n[   20.264668] Call trace:\n[   20.264669]  dump_backtrace+0xc4/0x130\n[   20.264672]  show_stack+0x24/0x80\n[   20.264673]  dump_stack_lvl+0x88/0xb4\n[   20.264676]  dump_stack+0x18/0x34\n[   20.264677]  __might_resched+0x1a0/0x280\n[   20.264679]  __might_sleep+0x58/0x90\n[   20.264681]  vmci_read_data+0x74/0x120 [vmw_vmci]\n[   20.264683]  vmci_dispatch_dgs+0x64/0x204 [vmw_vmci]\n[   20.264686]  tasklet_action_common.constprop.0+0x13c/0x150\n[   20.264688]  tasklet_action+0x40/0x50\n[   20.264689]  __do_softirq+0x23c/0x6b4\n[   20.264690]  __irq_exit_rcu+0x104/0x214\n[   20.264691]  irq_exit_rcu+0x1c/0x50\n[   20.264693]  el1_interrupt+0x38/0x6c\n[   20.264695]  el1h_64_irq_handler+0x18/0x24\n[   20.264696]  el1h_64_irq+0x68/0x6c\n[   20.264697]  preempt_count_sub+0xa4/0xe0\n[   20.264698]  _raw_spin_unlock_irqrestore+0x64/0xb0\n[   20.264701]  vmci_send_datagram+0x7c/0xa0 [vmw_vmci]\n[   20.264703]  vmci_datagram_dispatch+0x84/0x100 [vmw_vmci]\n[   20.264706]  vmci_datagram_send+0x2c/0x40 [vmw_vmci]\n[   20.264709]  vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport]\n[   20.264711]  vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport]\n[   20.264713]  vsock_connect+0x278/0x330 [vsock]\n[   20.264715]  __sys_connect_file+0x8c/0xc0\n[   20.264718]  __sys_connect+0x84/0xb4\n[   20.264720]  __arm64_sys_connect+0x2c/0x3c\n[   20.264721]  invoke_syscall+0x78/0x100\n[   20.264723]  el0_svc_common.constprop.0+0x68/0x124\n[   20.264724]  do_el0_svc+0x38/0x4c\n[   20.264725]  el0_svc+0x60/0x180\n[   20.264726]  el0t_64_sync_handler+0x11c/0x150\n[   20.264728]  el0t_64_sync+0x190/0x194"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:06:13.863Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/548ea9dd5e01b0ecf53d2563004c80abd636743d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3daed6345d5880464f46adab871d208e1baa2f3a"
        }
      ],
      "title": "VMCI: Use threaded irqs instead of tasklets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49759",
    "datePublished": "2025-03-27T16:43:06.197Z",
    "dateReserved": "2025-03-27T16:39:17.990Z",
    "dateUpdated": "2026-05-11T19:06:13.863Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49759",
      "date": "2026-09-19",
      "epss": "0.00129",
      "percentile": "0.02969"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/vmw_vmci/vmci_guest.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "548ea9dd5e01b0ecf53d2563004c80abd636743d",
                    "status": "affected",
                    "version": "463713eb6164b6577f8e91447c7745628215531b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3daed6345d5880464f46adab871d208e1baa2f3a",
                    "status": "affected",
                    "version": "463713eb6164b6577f8e91447c7745628215531b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/misc/vmw_vmci/vmci_guest.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "322A7D37-5D31-4288-87E6-2947F4E61BE1",
                    "versionEndExcluding": "6.1.8",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: Use threaded irqs instead of tasklets\n\nThe vmci_dispatch_dgs() tasklet function calls vmci_read_data()\nwhich uses wait_event() resulting in invalid sleep in an atomic\ncontext (and therefore potentially in a deadlock).\n\nUse threaded irqs to fix this issue and completely remove usage\nof tasklets.\n\n[   20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145\n[   20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd\n[   20.264645] preempt_count: 101, expected: 0\n[   20.264646] RCU nest depth: 0, expected: 0\n[   20.264647] 1 lock held by vmtoolsd/762:\n[   20.264648]  #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock]\n[   20.264658] Preemption disabled at:\n[   20.264659] [\u003cffff80000151d7d8\u003e] vmci_send_datagram+0x44/0xa0 [vmw_vmci]\n[   20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1\n[   20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020\n[   20.264668] Call trace:\n[   20.264669]  dump_backtrace+0xc4/0x130\n[   20.264672]  show_stack+0x24/0x80\n[   20.264673]  dump_stack_lvl+0x88/0xb4\n[   20.264676]  dump_stack+0x18/0x34\n[   20.264677]  __might_resched+0x1a0/0x280\n[   20.264679]  __might_sleep+0x58/0x90\n[   20.264681]  vmci_read_data+0x74/0x120 [vmw_vmci]\n[   20.264683]  vmci_dispatch_dgs+0x64/0x204 [vmw_vmci]\n[   20.264686]  tasklet_action_common.constprop.0+0x13c/0x150\n[   20.264688]  tasklet_action+0x40/0x50\n[   20.264689]  __do_softirq+0x23c/0x6b4\n[   20.264690]  __irq_exit_rcu+0x104/0x214\n[   20.264691]  irq_exit_rcu+0x1c/0x50\n[   20.264693]  el1_interrupt+0x38/0x6c\n[   20.264695]  el1h_64_irq_handler+0x18/0x24\n[   20.264696]  el1h_64_irq+0x68/0x6c\n[   20.264697]  preempt_count_sub+0xa4/0xe0\n[   20.264698]  _raw_spin_unlock_irqrestore+0x64/0xb0\n[   20.264701]  vmci_send_datagram+0x7c/0xa0 [vmw_vmci]\n[   20.264703]  vmci_datagram_dispatch+0x84/0x100 [vmw_vmci]\n[   20.264706]  vmci_datagram_send+0x2c/0x40 [vmw_vmci]\n[   20.264709]  vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport]\n[   20.264711]  vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport]\n[   20.264713]  vsock_connect+0x278/0x330 [vsock]\n[   20.264715]  __sys_connect_file+0x8c/0xc0\n[   20.264718]  __sys_connect+0x84/0xb4\n[   20.264720]  __arm64_sys_connect+0x2c/0x3c\n[   20.264721]  invoke_syscall+0x78/0x100\n[   20.264723]  el0_svc_common.constprop.0+0x68/0x124\n[   20.264724]  do_el0_svc+0x38/0x4c\n[   20.264725]  el0_svc+0x60/0x180\n[   20.264726]  el0t_64_sync_handler+0x11c/0x150\n[   20.264728]  el0t_64_sync+0x190/0x194"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: VMCI: Uso de IRQs con subprocesos en lugar de tasklets. La funci\u00f3n de tasklet vmci_dispatch_dgs() llama a vmci_read_data(), que utiliza wait_event(), lo que resulta en una suspensi\u00f3n no v\u00e1lida en un contexto at\u00f3mico (y, por lo tanto, potencialmente en un interbloqueo). Utilice IRQs con subprocesos para solucionar este problema y eliminar por completo el uso de tasklets. [ 20.264639] ERROR: funci\u00f3n de suspensi\u00f3n llamada desde un contexto no v\u00e1lido en drivers/misc/vmw_vmci/vmci_guest.c:145 [ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd [ 20.264645] preempt_count: 101, esperado: 0 [ 20.264646] Profundidad de anidamiento de RCU: 0, esperado: 0 [ 20.264647] 1 bloqueo retenido por vmtoolsd/762: [ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, en: vsock_connect+0x60/0x330 [vsock] [ 20.264658] Preempci\u00f3n deshabilitada en: [ 20.264659] [] vmci_send_datagram+0x44/0xa0 [vmw_vmci] [ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd No contaminado 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1 [ 20.264667] Nombre del hardware: VMware, Inc. VBSA/VBSA, BIOS VEFI 31/12/2020 [ 20.264668] Rastreo de llamadas: [ 20.264669] dump_backtrace+0xc4/0x130 [ 20.264672] show_stack+0x24/0x80 [ 20.264673] dump_stack_lvl+0x88/0xb4 [ 20.264676] dump_stack+0x18/0x34 [ 20.264677] __might_resched+0x1a0/0x280 [ 20.264679] __might_sleep+0x58/0x90 [ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci] [ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci] [ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150 [ 20.264688] tasklet_action+0x40/0x50 [ 20.264689] __do_softirq+0x23c/0x6b4 [ 20.264690] __irq_exit_rcu+0x104/0x214 [ 20.264691] irq_exit_rcu+0x1c/0x50 [ 20.264693] el1_interrupt+0x38/0x6c [ 20.264695] el1h_64_irq_handler+0x18/0x24 [ 20.264696] el1h_64_irq+0x68/0x6c [ 20.264697] preempt_count_sub+0xa4/0xe0 [ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0 [ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci] [ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci] [ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci] [ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport] [ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport] [ 20.264713] vsock_connect+0x278/0x330 [vsock] [ 20.264715] __sys_connect_file+0x8c/0xc0 [ 20.264718] __sys_connect+0x84/0xb4 [ 20.264720] __arm64_sys_connect+0x2c/0x3c [ 20.264721] invocar_syscall+0x78/0x100 [ 20.264723] el0_svc_common.constprop.0+0x68/0x124 [ 20.264724] do_el0_svc+0x38/0x4c [ 20.264725] el0_svc+0x60/0x180 [ 20.264726] el0t_64_sync_handler+0x11c/0x150 [ 20.264728] el0t_64_sync+0x190/0x194"
          }
        ],
        "id": "CVE-2022-49759",
        "lastModified": "2026-06-17T05:19:04.520",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49759",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:22:23.073608Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-03-27T17:15:41.163",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3daed6345d5880464f46adab871d208e1baa2f3a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/548ea9dd5e01b0ecf53d2563004c80abd636743d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:43:46+00:00",
      "cve": "CVE-2022-49759",
      "id": "CVE-2022-49759",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "152",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: VMCI: Use threaded irqs instead of tasklets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49759.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:26:21Z",
      "cve": "CVE-2022-49759",
      "id": "CVE-2022-49759",
      "initial_release_date": "2025-03-28T03:40:39Z",
      "product_status:known_affected": "377",
      "product_status:known_not_affected": "303",
      "product_status:recommended": "271",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49759",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49759.json",
      "version": "42"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49759",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T17:22:23.073608Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-667",
                    "description": "CWE-667 Improper Locking",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:59:35.976Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/misc/vmw_vmci/vmci_guest.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "548ea9dd5e01b0ecf53d2563004c80abd636743d",
                  "status": "affected",
                  "version": "463713eb6164b6577f8e91447c7745628215531b",
                  "versionType": "git"
                },
                {
                  "lessThan": "3daed6345d5880464f46adab871d208e1baa2f3a",
                  "status": "affected",
                  "version": "463713eb6164b6577f8e91447c7745628215531b",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/misc/vmw_vmci/vmci_guest.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.18"
                },
                {
                  "lessThan": "5.18",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.8",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2",
                      "versionStartIncluding": "5.18",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: Use threaded irqs instead of tasklets\n\nThe vmci_dispatch_dgs() tasklet function calls vmci_read_data()\nwhich uses wait_event() resulting in invalid sleep in an atomic\ncontext (and therefore potentially in a deadlock).\n\nUse threaded irqs to fix this issue and completely remove usage\nof tasklets.\n\n[   20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145\n[   20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd\n[   20.264645] preempt_count: 101, expected: 0\n[   20.264646] RCU nest depth: 0, expected: 0\n[   20.264647] 1 lock held by vmtoolsd/762:\n[   20.264648]  #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock]\n[   20.264658] Preemption disabled at:\n[   20.264659] [\u003cffff80000151d7d8\u003e] vmci_send_datagram+0x44/0xa0 [vmw_vmci]\n[   20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1\n[   20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020\n[   20.264668] Call trace:\n[   20.264669]  dump_backtrace+0xc4/0x130\n[   20.264672]  show_stack+0x24/0x80\n[   20.264673]  dump_stack_lvl+0x88/0xb4\n[   20.264676]  dump_stack+0x18/0x34\n[   20.264677]  __might_resched+0x1a0/0x280\n[   20.264679]  __might_sleep+0x58/0x90\n[   20.264681]  vmci_read_data+0x74/0x120 [vmw_vmci]\n[   20.264683]  vmci_dispatch_dgs+0x64/0x204 [vmw_vmci]\n[   20.264686]  tasklet_action_common.constprop.0+0x13c/0x150\n[   20.264688]  tasklet_action+0x40/0x50\n[   20.264689]  __do_softirq+0x23c/0x6b4\n[   20.264690]  __irq_exit_rcu+0x104/0x214\n[   20.264691]  irq_exit_rcu+0x1c/0x50\n[   20.264693]  el1_interrupt+0x38/0x6c\n[   20.264695]  el1h_64_irq_handler+0x18/0x24\n[   20.264696]  el1h_64_irq+0x68/0x6c\n[   20.264697]  preempt_count_sub+0xa4/0xe0\n[   20.264698]  _raw_spin_unlock_irqrestore+0x64/0xb0\n[   20.264701]  vmci_send_datagram+0x7c/0xa0 [vmw_vmci]\n[   20.264703]  vmci_datagram_dispatch+0x84/0x100 [vmw_vmci]\n[   20.264706]  vmci_datagram_send+0x2c/0x40 [vmw_vmci]\n[   20.264709]  vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport]\n[   20.264711]  vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport]\n[   20.264713]  vsock_connect+0x278/0x330 [vsock]\n[   20.264715]  __sys_connect_file+0x8c/0xc0\n[   20.264718]  __sys_connect+0x84/0xb4\n[   20.264720]  __arm64_sys_connect+0x2c/0x3c\n[   20.264721]  invoke_syscall+0x78/0x100\n[   20.264723]  el0_svc_common.constprop.0+0x68/0x124\n[   20.264724]  do_el0_svc+0x38/0x4c\n[   20.264725]  el0_svc+0x60/0x180\n[   20.264726]  el0t_64_sync_handler+0x11c/0x150\n[   20.264728]  el0t_64_sync+0x190/0x194"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T08:44:47.306Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/548ea9dd5e01b0ecf53d2563004c80abd636743d"
            },
            {
              "url": "https://git.kernel.org/stable/c/3daed6345d5880464f46adab871d208e1baa2f3a"
            }
          ],
          "title": "VMCI: Use threaded irqs instead of tasklets",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49759",
        "datePublished": "2025-03-27T16:43:06.197Z",
        "dateReserved": "2025-03-27T16:39:17.990Z",
        "dateUpdated": "2025-10-01T17:22:26.307Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.