# CVE-2022-49146: linux: In the Linux kernel, the following vulnerability has been resolved:  virtio: use virtio_device_ready() in virtio_devi...

CVE-2022-49146 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49146, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-49146
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0026
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 26, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  virtio: use virtio_device_ready() in virtio_device_restore()  After waking up a suspended VM, the kernel prints the following trace for virtio drivers which do not directly call virtio_device_ready() in the .restore:      PM: suspend exit     irq 22: nobody cared (try booting with the "irqpoll" option)     Call Trace:      <IRQ>      dump_stack_lvl+0x38/0x49      dump_stack+0x10/0x12      __report_bad_irq+0x3a/0xaf      note_interrupt.cold+0xb/0x60      handle_irq_event+0x71/0x80      handle_fasteoi_irq+0x95/0x1e0      __common_interrupt+0x6b/0x110      common_interrupt+0x63/0xe0      asm_common_interrupt+0x1e/0x40      ? __do_softirq+0x75/0x2f3      irq_exit_rcu+0x93/0xe0      sysvec_apic_timer_interrupt+0xac/0xd0      </IRQ>      <TASK>      asm_sysvec_apic_timer_interrupt+0x12/0x20      arch_cpu_idle+0x12/0x20      default_idle_call+0x39/0xf0      do_idle+0x1b5/0x210      cpu_startup_entry+0x20/0x30      start_secondary+0xf3/0x100      secondary_startup_64_no_verify+0xc3/0xcb      </TASK>     handlers:     [<000000008f9bac49>] vp_interrupt     [<000000008f9bac49>] vp_interrupt     Disabling IRQ #22  This happens because we don't invoke .enable_cbs callback in virtio_device_restore(). That callback is used by some transports (e.g. virtio-pci) to enable interrupts.  Let's fix it, by calling virtio_device_ready() as we do in virtio_dev_probe(). This function calls .enable_cts callback and sets DRIVER_OK status bit.  This fix also avoids setting DRIVER_OK twice for those drivers that call virtio_device_ready() in the .restore.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.17.3-1 | [DEBIAN-CVE-2022-49146](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49146.md) | Feb 26, 2025 |
| Linux | linux Debian 13.5 (trixie) | 5.17.3-1 | [DEBIAN-CVE-2022-49146](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49146.md) | Feb 26, 2025 |
| Linux | linux Debian 14 | 5.17.3-1 | [DEBIAN-CVE-2022-49146](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49146.md) | Feb 26, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.