CVE-2022-49090 is a vulnerability in the Linux kernel specifically affecting the ARM64 architecture's core scheduling topology initialization. The flaw arises because the function store_cpu_topology() fails to properly call update_siblings_masks() before notify_cpu_starting() is invoked. This sequence error causes the core scheduling data structures to be misconfigured, as the SMT (Simultaneous Multi-Threading) mask is not correctly set up. Consequently, the scheduler's internal representation of CPU topology does not match the actual hardware layout. This leads to the condition where the runqueue's core pointer (rq->core) is not correctly assigned for non-leader CPUs. When core scheduling is enabled, as in stress-ng tests using PR_SCHED_CORE, this misconfiguration triggers kernel warnings and ultimately causes a kernel crash due to a NULL pointer dereference. The crash occurs in the fair scheduler code path, specifically in cfs_prio_less(), pick_next_task(), and schedule_idle() functions. This vulnerability can cause system instability and denial of service on affected ARM64 Linux systems. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The issue was resolved by correcting the order of topology initialization calls to ensure SMT masks are properly set before notifying the scheduler of CPU startup.

For European organizations running ARM64-based Linux systems, particularly those utilizing core scheduling features, this vulnerability can lead to unexpected kernel crashes and system instability. This can disrupt critical services, especially in environments relying on ARM64 servers or embedded systems such as telecommunications infrastructure, cloud providers, and edge computing nodes. The denial of service caused by kernel panics could affect availability of applications and services, potentially leading to operational downtime and loss of productivity. Since the flaw is in the kernel scheduler, it may also impact performance and reliability of multi-threaded workloads. Although no direct exploitation for privilege escalation or data breach is indicated, the instability risk alone is significant for production environments. Organizations using ARM64 Linux kernels in data centers or critical infrastructure should prioritize patching to maintain service continuity.

Organizations should promptly apply the official Linux kernel patches that reorder the topology initialization sequence to correctly set SMT masks before CPU startup notifications. Specifically, updating to the latest stable kernel versions that include this fix is essential. For environments where immediate patching is challenging, disabling core scheduling features temporarily can mitigate the risk of kernel crashes. Additionally, thorough testing of ARM64 systems under load with core scheduling enabled should be conducted to detect any instability. Monitoring kernel logs for warnings related to task_rq or core scheduling can provide early indicators of this issue. Finally, organizations should maintain an up-to-date inventory of ARM64 Linux systems and ensure that automated patch management processes include kernel updates to reduce exposure time.