CVE-2022-49265: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49265 is a vulnerability in the Linux kernel's power management domain (PM domains) subsystem. The issue was discovered when a genpd (Generic Power Domain) with GENPD_FLAG_IRQ_SAFE gets removed, causing a sleep-in-atomic bug due to genpd_debug_remove() being called with a spinlock being held (NVD, RedHat).

The vulnerability manifests as a sleep-in-atomic bug in the kernel's power management domain subsystem. The issue occurs specifically when genpd_debug_remove() is called while holding a spinlock, which is not allowed in atomic context. The bug is triggered during the removal of a genpd with GENPD_FLAG_IRQ_SAFE flag set. According to the kernel logs, this results in a 'sleeping function called from invalid context' error at kernel/locking/rwsem.c:1460 (Kernel Commit).

The vulnerability can lead to system instability when removing power domains with specific flags set. This primarily affects system initialization and power management operations, potentially causing kernel panics or system crashes (RedHat).

The vulnerability requires local access and specific conditions to be triggered, specifically during the removal of power domains with GENPD_FLAG_IRQ_SAFE flag. The CVSS v3.1 base score is 5.5, indicating moderate severity with local access required (RedHat).

The issue has been fixed by moving the genpd_debug_remove() call outside of the locked section in the kernel code. The fix was implemented by modifying the code sequence in genpd_remove() function to ensure the debug removal happens after releasing the lock (Kernel Commit).