Refcount Leak in icp_opal_init() in powerpc/xics

Kernel Updated 02 Oct 2025

Summary

28/06/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1002699: powerpc/xics: fix refcount leak in icp_opal_init(). Affects Kernel versions < 9a42bc2494fadb453de00ce61042e588563ddc6d. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The powerpc/xics package is a component of the Linux Kernel, which is responsible for handling interrupt controllers on PowerPC systems. The icp_opal_init() function in this package initializes the interrupt controller for OpenPower Abstraction Layer (OPAL) systems. It manages the reference count for the interrupt controller, ensuring proper initialization and cleanup. However, a vulnerability has been discovered in this function that leads to a refcount leak.

Vulnerability Detail

The refcount leak vulnerability in icp_opal_init() occurs when the function fails to properly release the reference count on the interrupt controller in certain error scenarios. This can result in a resource leak, leading to potential memory corruption or denial of service. An attacker may be able to exploit this vulnerability to cause a system crash or execute arbitrary code with elevated privileges. The vulnerability has been assigned the ID GSD-2022-1002699 and has been fixed in Linux Kernel version v5.18.3.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Conclusion

In conclusion, the refcount leak vulnerability in icp_opal_init() in the powerpc/xics package of the Linux Kernel can lead to resource leaks and potential memory corruption or denial of service. It is crucial to update to Linux Kernel version v5.18.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →

FAQ

What is the impact of this vulnerability?

The vulnerability can lead to a resource leak, potentially resulting in memory corruption or denial of service. An attacker may be able to crash the system or execute arbitrary code with elevated privileges.

How can I check if my system is affected by this vulnerability?

You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time monitoring and alerts for open-source vulnerabilities.