CVE-2022-49896: cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak
In the Linux kernel, the following vulnerability has been resolved:
cxl/pmem: Fix cxlpmemregion and cxlmemdev leak
When a cxlnvdimm object goes through a ->remove() event (device physically removed, nvdimm-bridge disabled, or nvdimm device disabled), then any associated regions must also be disabled. As highlighted by the cxl-create-region.sh test [1], a single device may host multiple regions, but the driver was only tracking one region at a time. This leads to a situation where only the last enabled region per nvdimm device is cleaned up properly. Other regions are leaked, and this also causes cxlmemdev reference leaks.
Fix the tracking by allowing cxlnvdimm objects to track multiple region associations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49896?
The severity of CVE-2022-49896 is categorized as a moderate vulnerability in the Linux kernel.
How do I fix CVE-2022-49896?
To fix CVE-2022-49896, update the Linux kernel to a version that has addressed this vulnerability.
What impact does CVE-2022-49896 have on affected systems?
CVE-2022-49896 can lead to resource leaks in cxl_nvdimm objects, potentially affecting system performance.
Which Linux kernel versions are affected by CVE-2022-49896?
CVE-2022-49896 affects various versions of the Linux kernel prior to the patch release that addresses this issue.
Is CVE-2022-49896 being actively exploited in the wild?
As of now, there are no public reports indicating that CVE-2022-49896 is being actively exploited in the wild.