{"id":"DEBIAN-CVE-2022-49955","details":"In the Linux kernel, the following vulnerability has been resolved:  powerpc/rtas: Fix RTAS MSR[HV] handling for Cell  The semi-recent changes to MSR handling when entering RTAS (firmware) cause crashes on IBM Cell machines. An example trace:    kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0)   BUG: Unable to handle kernel instruction fetch   Faulting instruction address: 0x2fff01a8   Oops: Kernel access of bad area, sig: 11 [#1]   BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell   Modules linked in:   CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W          6.0.0-rc2-00433-gede0a8d3307a #207   NIP:  000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000   REGS: c0000000015236b0 TRAP: 0400   Tainted: G        W           (6.0.0-rc2-00433-gede0a8d3307a)   MSR:  0000000008001002 \u003cME,RI\u003e  CR: 00000000  XER: 20000000   ...   NIP 0x2fff01a8   LR  0x32608   Call Trace:     0xc00000000143c5f8 (unreliable)     .rtas_call+0x224/0x320     .rtas_get_boot_time+0x70/0x150     .read_persistent_clock64+0x114/0x140     .read_persistent_wall_and_boot_offset+0x24/0x80     .timekeeping_init+0x40/0x29c     .start_kernel+0x674/0x8f0     start_here_common+0x1c/0x50  Unlike PAPR platforms where RTAS is only used in guests, on the IBM Cell machines Linux runs with MSR[HV] set but also uses RTAS, provided by SLOF.  Fix it by copying the MSR[HV] bit from the MSR value we've just read using mfmsr into the value used for RTAS.  It seems like we could also fix it using an #ifdef CELL to set MSR[HV], but that doesn't work because it's possible to build a single kernel image that runs on both Cell native and pseries.","modified":"2026-09-01T20:04:56.833049541Z","published":"2025-06-18T11:15:22.630Z","upstream":["CVE-2022-49955"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49955"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49955.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49955.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49955.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}