CXL PMEM Region Leak in Linux Kernel - CVE-2022-49896
Summary
CVE-2022-49896: In the Linux kernel, the following vulnerability has been resolved: cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak When a cxl_nvdimm object goes through a ->remove() event (device physically removed, nvdimm-bridge dis... Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including memory management, process scheduling, and device control. The vulnerability identified as CVE-2022-49896 affects the cxl/pmem subsystem, which is responsible for managing persistent memory devices in the context of CXL (Compute Express Link) technology. This vulnerability can lead to resource leaks, impacting system stability and performance.
Vulnerability Detail
CVE-2022-49896 is a vulnerability in the Linux kernel's cxl/pmem subsystem that arises when a cxl_nvdimm object undergoes a ->remove() event. During this event, associated memory regions should be disabled. However, the driver only tracks one region at a time, resulting in leaks of other regions and cxl_memdev references. This can lead to resource exhaustion and potential system instability, as multiple regions associated with a single nvdimm device are not cleaned up properly.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49896 is a significant vulnerability in the Linux kernel's cxl/pmem subsystem that can lead to resource leaks and system instability. It is essential to update to the patched version 6.0.8-1 to mitigate the risks associated with this vulnerability. Regular monitoring and prompt updates are key to maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49896 is a vulnerability in the Linux kernel related to the cxl/pmem subsystem, which can lead to resource leaks when a cxl_nvdimm object is removed.
This vulnerability can cause resource exhaustion and system instability due to improper cleanup of memory regions associated with nvdimm devices.
Yes, the patched version for Debian 12 and 13 is 6.0.8-1. Updating to this version will resolve the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
