CVE-2022-49896

cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak

Medium · published May 1, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
6.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak

When a cxl_nvdimm object goes through a ->remove() event (device

physically removed, nvdimm-bridge disabled, or nvdimm device disabled),

then any associated regions must also be disabled. As highlighted by the

cxl-create-region.sh test [1], a single device may host multiple

regions, but the driver was only tracking one region at a time. This

leads to a situation where only the last enabled region per nvdimm

device is cleaned up properly. Other regions are leaked, and this also

causes cxl_memdev reference leaks.

Fix the tracking by allowing cxl_nvdimm objects to track multiple region

associations.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.1th percentile
Published
2025-05-01T14:10Z
EPSS history
Timeline
  • 01 MAY 14:10Z
    cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak
    cvelistv5