# CVE-2022-49764: bpf: Prevent bpf program recursion for raw tracepoint probes

CVE-2022-49764 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49764, released May 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-49764
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 1, 2025
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-49764

## Description

In the Linux kernel, the following vulnerability has been resolved:  bpf: Prevent bpf program recursion for raw tracepoint probes  We got report from sysbot [1] about warnings that were caused by bpf program attached to contention_begin raw tracepoint triggering the same tracepoint by using bpf_trace_printk helper that takes trace_printk_lock lock.   Call Trace:   <TASK>   ? trace_event_raw_event_bpf_trace_printk+0x5f/0x90   bpf_trace_printk+0x2b/0xe0   bpf_prog_a9aec6167c091eef_prog+0x1f/0x24   bpf_trace_run2+0x26/0x90   native_queued_spin_lock_slowpath+0x1c6/0x2b0   _raw_spin_lock_irqsave+0x44/0x50   bpf_trace_printk+0x3f/0xe0   bpf_prog_a9aec6167c091eef_prog+0x1f/0x24   bpf_trace_run2+0x26/0x90   native_queued_spin_lock_slowpath+0x1c6/0x2b0   _raw_spin_lock_irqsave+0x44/0x50   bpf_trace_printk+0x3f/0xe0   bpf_prog_a9aec6167c091eef_prog+0x1f/0x24   bpf_trace_run2+0x26/0x90   native_queued_spin_lock_slowpath+0x1c6/0x2b0   _raw_spin_lock_irqsave+0x44/0x50   bpf_trace_printk+0x3f/0xe0   bpf_prog_a9aec6167c091eef_prog+0x1f/0x24   bpf_trace_run2+0x26/0x90   native_queued_spin_lock_slowpath+0x1c6/0x2b0   _raw_spin_lock_irqsave+0x44/0x50   __unfreeze_partials+0x5b/0x160   ...  The can be reproduced by attaching bpf program as raw tracepoint on contention_begin tracepoint. The bpf prog calls bpf_trace_printk helper. Then by running perf bench the spin lock code is forced to take slow path and call contention_begin tracepoint.  Fixing this by skipping execution of the bpf program if it's already running, Using bpf prog 'active' field, which is being currently used by trampoline programs for the same reason.  Moving bpf_prog_inc_misses_counter to syscall.c because trampoline.c is compiled in just for CONFIG_BPF_JIT option.  [1] https://lore.kernel.org/bpf/YxhFe3EwqchC%2FfYf@krava/T/#t

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.0.10-1 | [DEBIAN-CVE-2022-49764](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49764.md) | May 1, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.0.10-1 | [DEBIAN-CVE-2022-49764](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49764.md) | May 1, 2025 |
| Linux | linux Debian 14 | 6.0.10-1 | [DEBIAN-CVE-2022-49764](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49764.md) | May 1, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.