CVE-2022-50494

A null pointer dereference flaw was found in the Linux kernel thermal/intel_powerclamp driver. When CPU 0 is offline and the intel_powerclamp driver attempts to inject idle cycles, the code incorrectly calls smp_processor_id() preemptively, which triggers a kernel BUG. This occurs because the function checks for the control CPU without holding the proper lock. A local user could use this flaw to crash the system, causing a denial of service

The issue is limited to systems where intel_powerclamp is enabled and configured to inject idle on non-boot CPUs. The crash occurs because smp_processor_id() is used without disabling preemption, resulting in an invalid access when CPU 0 is offline. The upstream patch replaces this with get_cpu() to ensure the CPU context is properly pinned and to prevent preemptible code from calling smp_processor_id().

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the intel_powerclamp module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.