CVE-2022-49613
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/02/2025
Last modified:
23/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
serial: 8250: Fix PM usage_count for console handover<br />
<br />
When console is enabled, univ8250_console_setup() calls<br />
serial8250_console_setup() before .dev is set to uart_port. Therefore,<br />
it will not call pm_runtime_get_sync(). Later, when the actual driver<br />
is going to take over univ8250_console_exit() is called. As .dev is<br />
already set, serial8250_console_exit() makes pm_runtime_put_sync() call<br />
with usage count being zero triggering PM usage count warning<br />
(extra debug for univ8250_console_setup(), univ8250_console_exit(), and<br />
serial8250_register_ports()):<br />
<br />
[ 0.068987] univ8250_console_setup ttyS0 nodev<br />
[ 0.499670] printk: console [ttyS0] enabled<br />
[ 0.717955] printk: console [ttyS0] printing thread started<br />
[ 1.960163] serial8250_register_ports assigned dev for ttyS0<br />
[ 1.976830] printk: console [ttyS0] disabled<br />
[ 1.976888] printk: console [ttyS0] printing thread stopped<br />
[ 1.977073] univ8250_console_exit ttyS0 usage:0<br />
[ 1.977075] serial8250 serial8250: Runtime PM usage count underflow!<br />
[ 1.977429] dw-apb-uart.6: ttyS0 at MMIO 0x4010006000 (irq = 33, base_baud = 115200) is a 16550A<br />
[ 1.977812] univ8250_console_setup ttyS0 usage:2<br />
[ 1.978167] printk: console [ttyS0] printing thread started<br />
[ 1.978203] printk: console [ttyS0] enabled<br />
<br />
To fix the issue, call pm_runtime_get_sync() in<br />
serial8250_register_ports() as soon as .dev is set for an uart_port<br />
if it has console enabled.<br />
<br />
This problem became apparent only recently because 82586a721595 ("PM:<br />
runtime: Avoid device usage count underflows") added the warning<br />
printout. I confirmed this problem also occurs with v5.18 (w/o the<br />
warning printout, obviously).
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.7 (including) | 5.10.132 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.56 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 5.18.13 (excluding) |
| cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



