cbcvebase.
CVE-2022-49784
published 2025-05-01

CVE-2022-49784: In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/uncore: Fix memory leak for events array When a CPU comes online, the per-CPU…

PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.16%
5.6th percentile
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/uncore: Fix memory leak for events array When a CPU comes online, the per-CPU NB and LLC uncore contexts are freed but not the events array within the context structure. This causes a memory leak as identified by the kmemleak detector. [...] unreferenced object 0xffff8c5944b8e320 (size 32): comm "swapper/0", pid 1, jiffies 4294670387 (age 151.072s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] amd_uncore_cpu_up_prepare+0xaf/0x230 [] cpuhp_invoke_callback+0x2cf/0x470 [] cpuhp_issue_call+0x14d/0x170 [] __cpuhp_setup_state_cpuslocked+0x11e/0x330 [] __cpuhp_setup_state+0x6b/0x110 [] amd_uncore_init+0x260/0x321 [] do_one_initcall+0x3f/0x1f0 [] kernel_init_freeable+0x1ca/0x212 [] kernel_init+0x11/0x120 [] ret_from_fork+0x22/0x30 unreferenced object 0xffff8c5944b8dd40 (size 64): comm "swapper/0", pid 1, jiffies 4294670387 (age 151.072s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] amd_uncore_cpu_up_prepare+0x183/0x230 [] cpuhp_invoke_callback+0x2cf/0x470 [] cpuhp_issue_call+0x14d/0x170 [] __cpuhp_setup_state_cpuslocked+0x11e/0x330 [] __cpuhp_setup_state+0x6b/0x110 [] amd_uncore_init+0x260/0x321 [] do_one_initcall+0x3f/0x1f0 [] kernel_init_freeable+0x1ca/0x212 [] kernel_init+0x11/0x120 [] ret_from_fork+0x22/0x30 [...] Fix the problem by freeing the events array before freeing the uncore context.

Affected

9 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.10-1 (bookworm)linux 6.0.10-1 (bookworm)
linuxlinux——
linuxlinux>= 39621c5808f5dda75d03dc4b2d4d2b13a5a1c34b < f75be9885d49e3717de962345c4572ddab52b178f75be9885d49e3717de962345c4572ddab52b178
linuxlinux>= 39621c5808f5dda75d03dc4b2d4d2b13a5a1c34b < bdfe34597139cfcecd47a2eb97fea44d77157491bdfe34597139cfcecd47a2eb97fea44d77157491
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 6.0.10-16.0.10-1
linuxlinux_kernel>= 0 < 6.0.10-16.0.10-1
linuxlinux_kernel>= 0 < 6.0.10-16.0.10-1
linuxlinux_kernel>= 6.0 < 6.0.106.0.10

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.