# cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()

CVE record · `CVE-2022-48671`

- **Identifiers:** `CVE-2022-48671`
- **State:** Confirmed
- **Severity:** CVSS 5.5 Medium
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-667](https://cwe.mitre.org/data/definitions/667.html)
- **Tags:** [CWE-667](https://agentprime.io/advisories/tag/cwe-667.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 3 May 2024
- **Updated:** 11 May 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 3 May 2024, 14:50 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `e446300968c6bd25d9cd6c33b9600780a39b3975 to before 321488cfac7d0eb6d97de467015ff754f85813ff` (git)
  - affected: `59c6902a96b4439e07c25ef86a4593bea5481c3b to before 07191f984842d50020789ff14c75da436a7f46a9` (git)
  - affected: `dee1e2b18cf5426eed985512ccc6636ec69dbdd6 to before 9f267393b036f1470fb12fb892d59e7ff8aeb58d` (git)
  - affected: `3bf4bf54069f9b62a54988e5d085023c17a66c90 to before 5db17805b6ba4c34dab303f49aea3562fc25af75` (git)
  - affected: `c0deb027c99c099aa6b831e326bfba802b25e774 to before 99bc25748e394d17f9e8b10cc7f273b8e64c1c7e` (git)
  - affected: `4f7e7236435ca0abe005c674ebd6892c6e83aeb3 to before 43626dade36fa74d3329046f4ae2d7fdefe401c6` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.4.213 to before 5.4.215` (semver)
  - affected: `5.10.143 to before 5.10.145` (semver)
  - affected: `5.15.68 to before 5.15.70` (semver)
  - affected: `5.19.9 to before 5.19.11` (semver)
  - Other versions: unaffected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 5.5 Medium, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`, from ADP (CISA-ADP)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0018, the 7th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 3 May 2024. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2022-48671](https://www.cve.org/CVERecord?id=CVE-2022-48671)
- [NVD: CVE-2022-48671](https://nvd.nist.gov/vuln/detail/CVE-2022-48671)

### References from the CNA

- <https://git.kernel.org/stable/c/321488cfac7d0eb6d97de467015ff754f85813ff>
- <https://git.kernel.org/stable/c/07191f984842d50020789ff14c75da436a7f46a9>
- <https://git.kernel.org/stable/c/9f267393b036f1470fb12fb892d59e7ff8aeb58d>
- <https://git.kernel.org/stable/c/5db17805b6ba4c34dab303f49aea3562fc25af75>
- <https://git.kernel.org/stable/c/99bc25748e394d17f9e8b10cc7f273b8e64c1c7e>
- <https://git.kernel.org/stable/c/43626dade36fa74d3329046f4ae2d7fdefe401c6>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2022-48671>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2022-48671/>. Everything for agents: <https://agentprime.io/llms.txt>.