CVE-2022-49896 cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak
A memory leak in the Linux kernel CXL PMEM driver allows attackers to cause denial of service by triggering device removal events.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49896?
CVE-2022-49896 is a medium-severity memory corruption vulnerability in Linux kernel, published on 1 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
cxl/pmem: Fix cxl_pmem_region and cxl_memdev leak
When a cxl_nvdimm object goes through a ->remove() event (device physically removed, nvdimm-bridge disabled, or nvdimm device disabled), then any associated regions must also be disabled. As highlighted by the cxl-create-region.sh test [1], a single device may host multiple regions, but the driver was only tracking one region at a time. This leads to a situation where only the last enabled region per nvdimm device is cleaned up properly. Other regions are leaked, and this also causes cxl_memdev reference leaks.
Fix the tracking by allowing cxl_nvdimm objects to track multiple region associations.
Which versions are affected by CVE-2022-49896?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49896?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-49896 being exploited?
There is no known exploitation of CVE-2022-49896 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49896, GHSA-3g7w-h796-wcg5, UBUNTU-CVE-2022-49896.