LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49000: iommu/vt-d: Fix PCI device refcount leak in has_external_pci()

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() before 'return true' to avoid reference count leak.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel resource-management flaw in Intel VT-d IOMMU handling. A PCI device reference count was not released on one return path, creating a leak. The public record does not provide CVSS, confirmed exploit activity, or business-impact detail, so urgency depends on whether affected kernels are present in critical systems.

Executive priority

Treat this as a routine kernel maintenance item unless your environment heavily depends on affected virtualization, IOMMU, or PCI passthrough hosts. There is no source-backed evidence of active exploitation or critical severity in the provided data.

Technical view

The flaw is in iommu/vt-d has_external_pci(). for_each_pci_dev() uses pci_get_device(), which increments the returned pci_dev reference. When the loop exits early with pdev still set, the missing pci_dev_put() leaks the reference. Stable kernel commits add the missing release before returning true.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions containing the VT-d IOMMU code path. The source bundle does not identify affected distributions, required kernel configuration, privileges, or remotely reachable attack surface.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source states active exploitation. The available evidence describes a kernel refcount leak fix, not a public exploit or weaponized technique.

Researcher notes

The key evidence is a missing pci_dev_put() on an early return in has_external_pci(). The source bundle lacks CVSS, CWE, exploitability analysis, distro mappings, and configuration prerequisites, so validation should focus on kernel version lineage and vendor backports.

Mitigation direction

  • Identify Linux kernel versions across servers, appliances, and virtualization hosts.
  • Prioritize systems using Intel VT-d or IOMMU features.
  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • If patch status is unclear, check official vendor kernel advisories.
  • Schedule reboots where required to activate updated kernels.

Validation and detection

  • Compare running kernel versions against vendor fixed-package guidance.
  • Confirm updated kernels include one of the referenced stable fixes or equivalent backport.
  • Review asset inventory for Linux hosts using IOMMU or PCI passthrough.
  • Check vulnerability scanner results for CVE-2022-49000 coverage.
  • Verify hosts rebooted into the patched kernel after updates.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49000 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux89a6079df791aeace2044ea93be1b397195824ec, 89a6079df791aeace2044ea93be1b397195824ec, 89a6079df791aeace2044ea93be1b397195824ec, 89a6079df791aeace2044ea93be1b397195824ecunaffected
LinuxLinux5.0, 0, 5.10.158, 5.15.82, 6.0.12, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.