LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49219: vfio/pci: fix memory leak during D3hot to D0 transition

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix memory leak during D3hot to D0 transition If 'vfio_pci_core_device::needs_pm_restore' is set (PCI device does not have No_Soft_Reset bit set in its PMCSR config register), then the current PCI state will be saved locally in 'vfio_pci_core_device::pm_save' during D0->D3hot transition and same will be restored back during D3hot->D0 transition. For saving the PCI state locally, pci_store_saved_state() is being used and the pci_load_and_free_saved_state() will free the allocated memory. But for reset related IOCTLs, vfio driver calls PCI reset-related API's which will internally change the PCI power state back to D0. So, when the guest resumes, then it will get the current state as D0 and it will skip the call to vfio_pci_set_power_state() for changing the power state to D0 explicitly. In this case, the memory pointed by 'pm_save' will never be freed. In a malicious sequence, the state changing to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET can be run in a loop and it can cause an OOM situation. This patch frees the earlier allocated memory first before overwriting 'pm_save' to prevent the mentioned memory leak.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-49219 is a Linux kernel VFIO PCI memory leak. On systems using PCI device passthrough, a malicious sequence of power-state changes and resets can repeatedly leak kernel memory, potentially causing an out-of-memory denial of service.

Executive priority

Prioritize patching virtualization hosts that provide PCI passthrough to guests or tenants. Business impact is service disruption from host memory exhaustion, not confirmed data theft or remote internet compromise from the provided evidence.

Technical view

The VFIO PCI path saves PCI state in pm_save during D0 to D3hot transitions. Reset-related IOCTL paths can return the device to D0 without the normal cleanup path, leaving pm_save allocated. The upstream fix frees previously allocated saved state before overwriting pm_save.

Likely exposure

Most relevant to Linux virtualization hosts using VFIO PCI passthrough, especially where guests or tenants can trigger VFIO device resets. Systems not using VFIO PCI passthrough are less likely to be exposed based on the provided sources.

Exploitation context

The CVE description states a malicious loop can cause an OOM condition. The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation appears to require local or guest-level access to VFIO-assigned PCI device reset functionality.

Researcher notes

The affected component is Linux kernel vfio/pci power-management handling. The fix addresses stale pm_save allocations when reset APIs change device power state outside the expected VFIO transition path. Version applicability should be confirmed against vendor kernels because the supplied affected-version data is incomplete and commit-based.

Mitigation direction

  • Apply vendor kernel updates containing the referenced VFIO PCI fix.
  • Check distribution advisories for exact fixed kernel versions.
  • Restrict VFIO PCI passthrough access to trusted workloads where possible.
  • Monitor affected virtualization hosts for memory exhaustion until patched.

Validation and detection

  • Inventory Linux hosts using VFIO PCI passthrough.
  • Identify running kernel versions and vendor patch status.
  • Compare kernels against the CVE record and distribution advisories.
  • Review whether untrusted guests can reset VFIO-assigned PCI devices.
  • Check logs for kernel OOM events on passthrough hosts.
Prepared
Confidence
medium
Sources
8

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49219 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux51ef3a004b1eb6241e56b3aa8495769a092a4dc2, 51ef3a004b1eb6241e56b3aa8495769a092a4dc2, 51ef3a004b1eb6241e56b3aa8495769a092a4dc2, 51ef3a004b1eb6241e56b3aa8495769a092a4dc2, 51ef3a004b1eb6241e56b3aa8495769a092a4dc2unaffected
LinuxLinux5.1, 0, 5.10.237, 5.15.33, 5.16.19, 5.17.2, 5.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.