CVE-2022-50738
published 2025-12-24CVE-2022-50738: In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: introduce…
PriorityP422low5.5
EPSS
0.21%
10.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")
we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
release to free all the resources allocated when processing user IOTLB
messages through vhost_vdpa_process_iotlb_update().
That commit changed the handling of IOTLB a bit, and we accidentally
removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call
vhost_vdpa_cleanup during the release") but a potential memory leak is
still there as showed by kmemleak if the application does not send
VHOST_IOTLB_INVALIDATE or crashes:
unreferenced object 0xffff888007fbaa30 (size 16):
comm "blkio-bench", pid 914, jiffies 4294993521 (age 885.500s)
hex dump (first 16 bytes):
40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00 @sA.............
backtrace:
[] kmem_cache_alloc_trace+0x142/0x1c0
[] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa]
[] vhost_chr_write_iter+0xc0/0x4a0 [vhost]
[] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa]
[] vfs_write+0x216/0x4b0
[] ksys_write+0x71/0xf0
[] __x64_sys_write+0x19/0x20
[] do_syscall_64+0x3f/0x90
[] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Let's fix this calling vhost_vdpa_iotlb_unmap() on the whole range in
vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup()
since we need a valid v->vdev.mm in vhost_vdpa_pa_unmap().
vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap()
on the whole range removes all the entries.
The kmemleak log reported was observed with a vDPA device that has `use_va`
set to true (e.g. VDUSE). This patch has been tested with both types of
devices.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.7-1 (bookworm) | linux 6.1.7-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 3d5698793897a2b9c0060d899881d1a0591630d5 < 4e92cb33bfb51eee5f28bb10846c46f266a4bb67 | 4e92cb33bfb51eee5f28bb10846c46f266a4bb67 |
| linux | linux | >= 3d5698793897a2b9c0060d899881d1a0591630d5 < a2907867e2c86067accd2f011d6f23ee5533aa6c | a2907867e2c86067accd2f011d6f23ee5533aa6c |
| linux | linux | >= 3d5698793897a2b9c0060d899881d1a0591630d5 < c070c1912a83432530cbb4271d5b9b11fa36b67a | c070c1912a83432530cbb4271d5b9b11fa36b67a |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 5.19.0 < 6.0.19 | 6.0.19 |
| linux | linux_kernel | >= 6.1.0 < 6.1.5 | 6.1.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2022-50738 [LOW] CWE-772 kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")
we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
release to free all the resources allocated when processing user IOTLB
messages through vhost_vdpa_process_iotlb_update().
That commit changed the handling of IOTLB a bit, and we accidentally
removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call
vhost_vdpa_cleanup during the release") but a potential memory leak is
still there as showed by kmemleak if the application does not send
VHOST_IOTLB_INVALIDATE or crashes:
unrefe
Debian
CVE-2022-50738: linux - In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa:...
vendor_debian·2022
CVE-2022-50738 CVE-2022-50738: linux - In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa:...
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free all the resources allocated when processing user IOTLB messages through vhost_vdpa_process_iotlb_update(). That commit changed the handling of IOTLB a bit, and we accidentally removed some code called during the release. We partially fixed this with commit 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") but a potential memory leak is still there as showed by kmemleak if the application does not send VHOST_IOTLB_INVALIDATE or crashes: unreferenced object 0xffff888007fbaa30 (size 16): comm "blkio-bench", pid 914, ji
VulDB
Linux Kernel up to 6.0.18/6.1.4 IOTLB vhost_vdpa_process_iotlb_update memory leak (Nessus ID 279876 / WID-SEC-2025-2929)
vuldb·2026-04-21
CVE-2022-50738 [CRITICAL] Linux Kernel up to 6.0.18/6.1.4 IOTLB vhost_vdpa_process_iotlb_update memory leak (Nessus ID 279876 / WID-SEC-2025-2929)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.0.18/6.1.4. Affected by this issue is the function vhost_vdpa_process_iotlb_update of the component IOTLB Handler. Performing a manipulation results in memory leak.
This vulnerability is identified as CVE-2022-50738. The attack can only be performed from the local network. There is not any exploit available.
It is advisable to upgrade the affected component.
OSV
vhost-vdpa: fix an iotlb memory leak
osv·2025-12-24
CVE-2022-50738 vhost-vdpa: fix an iotlb memory leak
vhost-vdpa: fix an iotlb memory leak
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")
we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
release to free all the resources allocated when processing user IOTLB
messages through vhost_vdpa_process_iotlb_update().
That commit changed the handling of IOTLB a bit, and we accidentally
removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call
vhost_vdpa_cleanup during the release") but a potential memory leak is
still there as showed by kmemleak if the application does not send
VHOST_IOTLB_INVALIDATE or crashes:
unreferenced object 0xffff888007fbaa30
OSV
CVE-2022-50738: In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: intr
osv·2025-12-24
CVE-2022-50738 CVE-2022-50738: In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: intr
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free all the resources allocated when processing user IOTLB messages through vhost_vdpa_process_iotlb_update(). That commit changed the handling of IOTLB a bit, and we accidentally removed some code called during the release. We partially fixed this with commit 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") but a potential memory leak is still there as showed by kmemleak if the application does not send VHOST_IOTLB_INVALIDATE or crashes: unreferenced object 0xffff888007fbaa30 (size 16): comm "blkio-bench", pid 914, ji
GHSA
GHSA-hfjw-rcpx-5rv6: In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: in
ghsa_unreviewed·2025-12-24
CVE-2022-50738 GHSA-hfjw-rcpx-5rv6: In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: in
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")
we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
release to free all the resources allocated when processing user IOTLB
messages through vhost_vdpa_process_iotlb_update().
That commit changed the handling of IOTLB a bit, and we accidentally
removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call
vhost_vdpa_cleanup during the release") but a potential memory leak is
still there as showed by kmemleak if the application does not send
VHOST_IOTLB_INVALIDATE or crashes:
unreferenced object 0xffff888007fbaa30 (size 16):
comm "blkio-bench", pid 914
No detection rules found.
No public exploits indexed.
Wiz
CVE-2022-50738 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50738 CVE-2022-50738 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50738 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")
we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
release to free all the resources allocated when processing user IOTLB
messages through vhost_vdpa_process_iotlb_update().
That commit changed the handling of IOTLB a bit, and we accidentally
removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call
vhost_vdpa_cleanup during the release") but a potential memory leak is
still there as showed by kmemleak if the application does not send
VHOST_IOTLB_INVALIDATE or crashes:
unre
Bugzilla
CVE-2022-50738 kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
bugzilla·2025-12-24
CVE-2022-50738 [LOW] CVE-2022-50738 kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
CVE-2022-50738 kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")
we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during
release to free all the resources allocated when processing user IOTLB
messages through vhost_vdpa_process_iotlb_update().
That commit changed the handling of IOTLB a bit, and we accidentally
removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call
vhost_vdpa_cleanup during the release") but a potential memory leak is
still there as showed by kmemleak if the application does not send
VHOST_IOTLB_INVALIDATE
2025-12-24
Published