Security readout for executives and security teams
Plain-English summary
CVE-2022-50738 is a Linux kernel memory leak in vhost-vdpa cleanup. If an application using this interface fails to invalidate mappings or crashes, kernel memory may not be freed. The main business concern is reliability degradation on hosts using vDPA/VDUSE-style virtualization or I/O acceleration features.
Executive priority
Treat as a targeted reliability patch for specialized Linux virtualization or I/O hosts. It is not currently supported by public evidence of active exploitation, but affected infrastructure should be updated during normal security maintenance, sooner for high-density or memory-sensitive platforms.
Technical view
The issue is in Linux kernel vhost-vdpa IOTLB handling after ASID-based IOTLB changes. Cleanup no longer fully released IOTLB entries created from user IOTLB updates. The fix calls vhost_vdpa_iotlb_unmap() across the full range during address-space removal before vhost_dev_cleanup().
Likely exposure
Exposure is likely limited to Linux systems using vhost-vdpa, vDPA, or VDUSE-related devices. General Linux servers not using these kernel facilities are less likely to be affected. The provided data lists Linux kernel versions including 5.19, 6.0.19, 6.1.5, and 6.2 as affected entries, but version applicability should be confirmed with vendor advisories.
Exploitation context
No CISA KEV listing or source evidence of active exploitation is provided. The described trigger is an application that does not send VHOST_IOTLB_INVALIDATE or crashes, leaving allocations unreferenced. The practical impact appears to be memory leakage rather than direct code execution.
Researcher notes
The source describes kmemleak output from blkio-bench and notes testing with devices where use_va is true, such as VDUSE, and with both device types. Severity, CVSS, and CWE are not provided, so impact assessment remains bounded by the published kernel description.
Mitigation direction
- Apply Linux kernel updates containing the referenced stable fixes.
- Prioritize hosts using vhost-vdpa, vDPA, or VDUSE workloads.
- Check your Linux distribution or appliance vendor guidance for backported fixes.
- Plan maintenance for virtualization or I/O acceleration hosts if affected.
Validation and detection
- Inventory Linux hosts using vhost-vdpa, vDPA, or VDUSE.
- Compare running kernel builds against vendor-fixed kernel advisories.
- Review kernel package changelogs for the referenced vhost-vdpa IOTLB cleanup fix.
- Monitor affected hosts for unexplained kernel memory growth during relevant workloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.