CVE-2022-50771: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50771 is a Linux kernel vulnerability in the RCU (Read-Copy-Update) subsystem where rcu_force_quiescent_state() incorrectly uses __this_cpu_read() in preemptible code instead of the safe raw_cpu_read(), triggering a lockdep warning. The issue manifests when running rcutorture with a non-zero fqs_duration module parameter on kernels built with CONFIG_PREEMPTION=y. It affects the Linux kernel across multiple stable branches and was published on December 24, 2025. Feedly estimates the severity as HIGH, with an EPSS score of 0.000240 (Feedly, EUVD).

The root cause is an improper use of the per-CPU accessor macro __this_cpu_read() within preemptible kernel code in rcu_force_quiescent_state(). In kernels with CONFIG_PREEMPTION=y, this macro is not safe to call without preemption disabled, as the executing CPU could change between the read and its use — a condition detected and reported by the kernel's lockdep infrastructure. The correct accessor, raw_cpu_read(), bypasses the preemption check and is appropriate here because the RCU state read does not require strict per-CPU consistency guarantees in this context. The fix replaces __this_cpu_read() with raw_cpu_read() in the affected function (Feedly, EUVD).

The primary impact of this vulnerability is a kernel warning (splat) and potential instability in the RCU subsystem when the affected code path is triggered under preemptible kernel configurations. This is a reliability and availability issue rather than a direct confidentiality or integrity breach; however, incorrect per-CPU state reads in the RCU subsystem could theoretically contribute to subtle race conditions or kernel instability. The issue is limited to systems running kernels with CONFIG_PREEMPTION=y and using the rcutorture module with non-zero fqs_duration (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to these or later stable kernel releases. The relevant upstream commits are available at the kernel.org stable tree (EUVD). As a temporary workaround, avoiding the use of the rcutorture module with non-zero fqs_duration on preemptible kernels will prevent the warning from triggering.