{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-49069 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-49069 is a medium-severity denial of service vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-49069 and fix it if it is affected.\n\nWhat it is: CVE-2022-49069 is a medium-severity denial of service vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-49069 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-49069/ (Markdown: https://insights.sbomify.com/CVE-2022-49069/index.md)","id":"CVE-2022-49069","markdown":"https://insights.sbomify.com/CVE-2022-49069/index.md","name":"CVE-2022-49069","record":{"aliases":["AZL-68462","DEBIAN-CVE-2022-49069","GHSA-63x2-r5m2-h8pv","ROOT-OS-DEBIAN-11-CVE-2022-49069","ROOT-OS-UBUNTU-2204-CVE-2022-49069","UBUNTU-CVE-2022-49069"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A missing FPU protection in the AMD display driver causes a general protection fault and system crash during heavy WebGL usage.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw\n\n[Why]\nBelow general protection fault observed when WebGL Aquarium is run for\nlonger duration. If drm debug logs are enabled and set to 0x1f then the\nissue is observed within 10 minutes of run.\n\n[  100.717056] general protection fault, probably for non-canonical address 0x2d33302d32323032: 0000 [#1] PREEMPT SMP NOPTI\n[  100.727921] CPU: 3 PID: 1906 Comm: DrmThread Tainted: G        W         5.15.30 #12 d726c6a2d6ebe5cf9223931cbca6892f916fe18b\n[  100.754419] RIP: 0010:CalculateSwathWidth+0x1f7/0x44f\n[  100.767109] Code: 00 00 00 f2 42 0f 11 04 f0 48 8b 85 88 00 00 00 f2 42 0f 10 04 f0 48 8b 85 98 00 00 00 f2 42 0f 11 04 f0 48 8b 45 10 0f 57 c0 \u003cf3\u003e 42 0f 2a 04 b0 0f 57 c9 f3 43 0f 2a 0c b4 e8 8c e2 f3 ff 48 8b\n[  100.781269] RSP: 0018:ffffa9230079eeb0 EFLAGS: 00010246\n[  100.812528] RAX: 2d33302d32323032 RBX: 0000000000000500 RCX: 0000000000000000\n[  100.819656] RDX: 0000000000000001 RSI: ffff99deb712c49c RDI: 0000000000000000\n[  100.826781] RBP: ffffa9230079ef50 R08: ffff99deb712460c R09: ffff99deb712462c\n[  100.833907] R10: ffff99deb7124940 R11: ffff99deb7124d70 R12: ffff99deb712ae44\n[  100.841033] R13: 0000000000000001 R14: 0000000000000000 R15: ffffa9230079f0a0\n[  100.848159] FS:  00007af121212640(0000) GS:ffff99deba780000(0000) knlGS:0000000000000000\n[  100.856240] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  100.861980] CR2: 0000209000fe1000 CR3: 000000011b18c000 CR4: 0000000000350ee0\n[  100.869106] Call Trace:\n[  100.871555]  \u003cTASK\u003e\n[  100.873655]  ? asm_sysvec_reschedule_ipi+0x12/0x20\n[  100.878449]  CalculateSwathAndDETConfiguration+0x1a3/0x6dd\n[  100.883937]  dml31_ModeSupportAndSystemConfigurationFull+0x2ce4/0x76da\n[  100.890467]  ? kallsyms_lookup_buildid+0xc8/0x163\n[  100.895173]  ? kallsyms_lookup_buildid+0xc8/0x163\n[  100.899874]  ? __sprint_symbol+0x80/0x135\n[  100.903883]  ? dm_update_plane_state+0x3f9/0x4d2\n[  100.908500]  ? symbol_string+0xb7/0xde\n[  100.912250]  ? number+0x145/0x29b\n[  100.915566]  ? vsnprintf+0x341/0x5ff\n[  100.919141]  ? desc_read_finalized_seq+0x39/0x87\n[  100.923755]  ? update_load_avg+0x1b9/0x607\n[  100.927849]  ? compute_mst_dsc_configs_for_state+0x7d/0xd5b\n[  100.933416]  ? fetch_pipe_params+0xa4d/0xd0c\n[  100.937686]  ? dc_fpu_end+0x3d/0xa8\n[  100.941175]  dml_get_voltage_level+0x16b/0x180\n[  100.945619]  dcn30_internal_validate_bw+0x10e/0x89b\n[  100.950495]  ? dcn31_validate_bandwidth+0x68/0x1fc\n[  100.955285]  ? resource_build_scaling_params+0x98b/0xb8c\n[  100.960595]  ? dcn31_validate_bandwidth+0x68/0x1fc\n[  100.965384]  dcn31_validate_bandwidth+0x9a/0x1fc\n[  100.970001]  dc_validate_global_state+0x238/0x295\n[  100.974703]  amdgpu_dm_atomic_check+0x9c1/0xbce\n[  100.979235]  ? _printk+0x59/0x73\n[  100.982467]  drm_atomic_check_only+0x403/0x78b\n[  100.986912]  drm_mode_atomic_ioctl+0x49b/0x546\n[  100.991358]  ? drm_ioctl+0x1c1/0x3b3\n[  100.994936]  ? drm_atomic_set_property+0x92a/0x92a\n[  100.999725]  drm_ioctl_kernel+0xdc/0x149\n[  101.003648]  drm_ioctl+0x27f/0x3b3\n[  101.007051]  ? drm_atomic_set_property+0x92a/0x92a\n[  101.011842]  amdgpu_drm_ioctl+0x49/0x7d\n[  101.015679]  __se_sys_ioctl+0x7c/0xb8\n[  101.015685]  do_syscall_64+0x5f/0xb8\n[  101.015690]  ? __irq_exit_rcu+0x34/0x96\n\n[How]\nIt calles populate_dml_pipes which uses doubles to initialize.\nAdding FPU protection avoids context switch and probable loss of vba context\nas there is potential contention while drm debug logs are enabled.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw","id":"CVE-2022-49069","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2022"},"n_packages":0,"n_references":3,"next":{"headline":"fbdev: Fix unregistering of framebuffers without device","id":"CVE-2022-49070"},"packages":[],"prev":{"headline":"btrfs: release correct delalloc amount in direct IO write path","id":"CVE-2022-49068"},"products":["Linux"],"published":"2025-02-26","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-12","vendors":["Linux"]},"summary":"A missing FPU protection in the AMD display driver causes a general protection fault and system crash during heavy WebGL usage.","url":"https://insights.sbomify.com/CVE-2022-49069/"}