LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49436: powerpc/papr_scm: Fix leaking nvdimm_events_map elements

In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: Fix leaking nvdimm_events_map elements Right now 'char *' elements allocated for individual 'stat_id' in 'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths. Also individual 'stat_id' arent NULL terminated 'char *' instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated 'char *' and at other places it assumes it to be a 'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size. Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for 'stat_id' entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code can continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to iterate over the array and free up individual elements.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49436 is a Linux kernel defect in the PowerPC papr_scm persistent memory driver. It leaks small event-mapping allocations and mishandles fixed-size stat_id identifiers as strings. The sources do not provide CVSS, impact severity, or evidence of active exploitation.

Executive priority

Treat this as a targeted platform hygiene issue unless your estate includes PowerPC persistent-memory workloads. Patch during normal kernel maintenance, escalating priority for critical systems that use papr_scm or show unexplained memory pressure.

Technical view

The bug is in powerpc/papr_scm. nvdimm_events_map stat_id elements allocated during papr_scm_pmu_check_events() were leaked in remove, register, and error paths. The fix stores fixed 8-byte stat_id entries within the main allocation, avoiding per-entry frees and string termination assumptions.

Likely exposure

Exposure appears limited to Linux systems using the PowerPC papr_scm driver and affected kernel versions identified in the CVE data. Environments without that architecture, driver, or persistent memory path are less likely to be exposed, but downstream backport status must be checked.

Exploitation context

CISA KEV status is false, and the supplied sources do not describe public exploitation, a working exploit, or a remote attack path. The available evidence supports a kernel memory-management vulnerability, not confirmed active exploitation.

Researcher notes

The source data identifies the vulnerable logic and stable commit references but omits CVSS, CWE, exploitability details, and distro-specific package status. Avoid broad claims beyond PowerPC papr_scm unless confirmed by vendor advisories or code review.

Mitigation direction

  • Check Linux vendor or distribution guidance for affected kernel packages.
  • Update to a kernel containing the referenced stable fixes or downstream backports.
  • Prioritize PowerPC systems using papr_scm or NVDIMM persistent memory.
  • If patching is delayed, monitor affected systems for memory pressure symptoms.

Validation and detection

  • Inventory PowerPC Linux systems and their kernel versions.
  • Determine whether papr_scm persistent memory functionality is present or enabled.
  • Confirm whether kernel builds include the referenced stable commits or backports.
  • Review operational monitoring for memory growth around driver registration or removal paths.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49436 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b, 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10bunaffected
LinuxLinux5.18, 0, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.