GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50738 (GCVE-0-2022-50738)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:05 – Updated: 2026-05-11 19:24
VLAI
Title
vhost-vdpa: fix an iotlb memory leak
Summary
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free all the resources allocated when processing user IOTLB messages through vhost_vdpa_process_iotlb_update(). That commit changed the handling of IOTLB a bit, and we accidentally removed some code called during the release. We partially fixed this with commit 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") but a potential memory leak is still there as showed by kmemleak if the application does not send VHOST_IOTLB_INVALIDATE or crashes: unreferenced object 0xffff888007fbaa30 (size 16): comm "blkio-bench", pid 914, jiffies 4294993521 (age 885.500s) hex dump (first 16 bytes): 40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00 @sA............. backtrace: [<0000000087736d2a>] kmem_cache_alloc_trace+0x142/0x1c0 [<0000000060740f50>] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa] [<0000000083e8e205>] vhost_chr_write_iter+0xc0/0x4a0 [vhost] [<000000008f2f414a>] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa] [<00000000de1cd4a0>] vfs_write+0x216/0x4b0 [<00000000a2850200>] ksys_write+0x71/0xf0 [<00000000de8e720b>] __x64_sys_write+0x19/0x20 [<0000000018b12cbb>] do_syscall_64+0x3f/0x90 [<00000000986ec465>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Let's fix this calling vhost_vdpa_iotlb_unmap() on the whole range in vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup() since we need a valid v->vdev.mm in vhost_vdpa_pa_unmap(). vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap() on the whole range removes all the entries. The kmemleak log reported was observed with a vDPA device that has `use_va` set to true (e.g. VDUSE). This patch has been tested with both types of devices.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3d5698793897a2b9c0060d899881d1a0591630d5 , < 4e92cb33bfb51eee5f28bb10846c46f266a4bb67 (git)
Affected: 3d5698793897a2b9c0060d899881d1a0591630d5 , < a2907867e2c86067accd2f011d6f23ee5533aa6c (git)
Affected: 3d5698793897a2b9c0060d899881d1a0591630d5 , < c070c1912a83432530cbb4271d5b9b11fa36b67a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.0.19 , ≤ 6.0.* (semver)
Unaffected: 6.1.5 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/vdpa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e92cb33bfb51eee5f28bb10846c46f266a4bb67",
              "status": "affected",
              "version": "3d5698793897a2b9c0060d899881d1a0591630d5",
              "versionType": "git"
            },
            {
              "lessThan": "a2907867e2c86067accd2f011d6f23ee5533aa6c",
              "status": "affected",
              "version": "3d5698793897a2b9c0060d899881d1a0591630d5",
              "versionType": "git"
            },
            {
              "lessThan": "c070c1912a83432530cbb4271d5b9b11fa36b67a",
              "status": "affected",
              "version": "3d5698793897a2b9c0060d899881d1a0591630d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/vdpa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.19",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix an iotlb memory leak\n\nBefore commit 3d5698793897 (\"vhost-vdpa: introduce asid based IOTLB\")\nwe called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during\nrelease to free all the resources allocated when processing user IOTLB\nmessages through vhost_vdpa_process_iotlb_update().\nThat commit changed the handling of IOTLB a bit, and we accidentally\nremoved some code called during the release.\n\nWe partially fixed this with commit 037d4305569a (\"vhost-vdpa: call\nvhost_vdpa_cleanup during the release\") but a potential memory leak is\nstill there as showed by kmemleak if the application does not send\nVHOST_IOTLB_INVALIDATE or crashes:\n\n  unreferenced object 0xffff888007fbaa30 (size 16):\n    comm \"blkio-bench\", pid 914, jiffies 4294993521 (age 885.500s)\n    hex dump (first 16 bytes):\n      40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00  @sA.............\n    backtrace:\n      [\u003c0000000087736d2a\u003e] kmem_cache_alloc_trace+0x142/0x1c0\n      [\u003c0000000060740f50\u003e] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa]\n      [\u003c0000000083e8e205\u003e] vhost_chr_write_iter+0xc0/0x4a0 [vhost]\n      [\u003c000000008f2f414a\u003e] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa]\n      [\u003c00000000de1cd4a0\u003e] vfs_write+0x216/0x4b0\n      [\u003c00000000a2850200\u003e] ksys_write+0x71/0xf0\n      [\u003c00000000de8e720b\u003e] __x64_sys_write+0x19/0x20\n      [\u003c0000000018b12cbb\u003e] do_syscall_64+0x3f/0x90\n      [\u003c00000000986ec465\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nLet\u0027s fix this calling vhost_vdpa_iotlb_unmap() on the whole range in\nvhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup()\nsince we need a valid v-\u003evdev.mm in vhost_vdpa_pa_unmap().\nvhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap()\non the whole range removes all the entries.\n\nThe kmemleak log reported was observed with a vDPA device that has `use_va`\nset to true (e.g. VDUSE). This patch has been tested with both types of\ndevices."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:24:33.729Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e92cb33bfb51eee5f28bb10846c46f266a4bb67"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2907867e2c86067accd2f011d6f23ee5533aa6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c070c1912a83432530cbb4271d5b9b11fa36b67a"
        }
      ],
      "title": "vhost-vdpa: fix an iotlb memory leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50738",
    "datePublished": "2025-12-24T13:05:36.801Z",
    "dateReserved": "2025-12-24T13:02:21.542Z",
    "dateUpdated": "2026-05-11T19:24:33.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50738",
      "date": "2026-09-16",
      "epss": "0.00232",
      "percentile": "0.14188"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50738\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:00.503\",\"lastModified\":\"2026-06-17T05:24:05.663\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvhost-vdpa: fix an iotlb memory leak\\n\\nBefore commit 3d5698793897 (\\\"vhost-vdpa: introduce asid based IOTLB\\\")\\nwe called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during\\nrelease to free all the resources allocated when processing user IOTLB\\nmessages through vhost_vdpa_process_iotlb_update().\\nThat commit changed the handling of IOTLB a bit, and we accidentally\\nremoved some code called during the release.\\n\\nWe partially fixed this with commit 037d4305569a (\\\"vhost-vdpa: call\\nvhost_vdpa_cleanup during the release\\\") but a potential memory leak is\\nstill there as showed by kmemleak if the application does not send\\nVHOST_IOTLB_INVALIDATE or crashes:\\n\\n  unreferenced object 0xffff888007fbaa30 (size 16):\\n    comm \\\"blkio-bench\\\", pid 914, jiffies 4294993521 (age 885.500s)\\n    hex dump (first 16 bytes):\\n      40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00  @sA.............\\n    backtrace:\\n      [\u003c0000000087736d2a\u003e] kmem_cache_alloc_trace+0x142/0x1c0\\n      [\u003c0000000060740f50\u003e] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa]\\n      [\u003c0000000083e8e205\u003e] vhost_chr_write_iter+0xc0/0x4a0 [vhost]\\n      [\u003c000000008f2f414a\u003e] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa]\\n      [\u003c00000000de1cd4a0\u003e] vfs_write+0x216/0x4b0\\n      [\u003c00000000a2850200\u003e] ksys_write+0x71/0xf0\\n      [\u003c00000000de8e720b\u003e] __x64_sys_write+0x19/0x20\\n      [\u003c0000000018b12cbb\u003e] do_syscall_64+0x3f/0x90\\n      [\u003c00000000986ec465\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nLet\u0027s fix this calling vhost_vdpa_iotlb_unmap() on the whole range in\\nvhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup()\\nsince we need a valid v-\u003evdev.mm in vhost_vdpa_pa_unmap().\\nvhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap()\\non the whole range removes all the entries.\\n\\nThe kmemleak log reported was observed with a vDPA device that has `use_va`\\nset to true (e.g. VDUSE). This patch has been tested with both types of\\ndevices.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/vhost/vdpa.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3d5698793897a2b9c0060d899881d1a0591630d5\",\"lessThan\":\"4e92cb33bfb51eee5f28bb10846c46f266a4bb67\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d5698793897a2b9c0060d899881d1a0591630d5\",\"lessThan\":\"a2907867e2c86067accd2f011d6f23ee5533aa6c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3d5698793897a2b9c0060d899881d1a0591630d5\",\"lessThan\":\"c070c1912a83432530cbb4271d5b9b11fa36b67a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/vhost/vdpa.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.19\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.5\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4e92cb33bfb51eee5f28bb10846c46f266a4bb67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2907867e2c86067accd2f011d6f23ee5533aa6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c070c1912a83432530cbb4271d5b9b11fa36b67a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:33:00+00:00",
      "cve": "CVE-2022-50738",
      "id": "CVE-2022-50738",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50738.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:21:13Z",
      "cve": "CVE-2022-50738",
      "id": "CVE-2022-50738",
      "initial_release_date": "2025-12-25T01:04:32Z",
      "product_status:known_affected": "374",
      "product_status:known_not_affected": "488",
      "product_status:recommended": "114",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50738",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50738.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.