CVE-2022-49896
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
01/05/2025
Last modified:
07/05/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak<br />
<br />
When a cxl_nvdimm object goes through a ->remove() event (device<br />
physically removed, nvdimm-bridge disabled, or nvdimm device disabled),<br />
then any associated regions must also be disabled. As highlighted by the<br />
cxl-create-region.sh test [1], a single device may host multiple<br />
regions, but the driver was only tracking one region at a time. This<br />
leads to a situation where only the last enabled region per nvdimm<br />
device is cleaned up properly. Other regions are leaked, and this also<br />
causes cxl_memdev reference leaks.<br />
<br />
Fix the tracking by allowing cxl_nvdimm objects to track multiple region<br />
associations.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.0 (including) | 6.0.8 (excluding) |
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* | ||
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page