CVE-2022-48700

What it actually does

Reference count leak on the zero page in vfio/type1: pin_user_pages_remote increments the count but put_pfn does not unpin the zero page, allowing a single process to create enough mappings to overflow the reference count.

Why it matters to the business

Unpatched systems using VFIO for device passthrough or virtualization may experience kernel instability, reference count overflows, or denial of service; widespread use of Linux in servers and cloud environments increases exposure across many organizations.

How an attack unfolds

An attacker with access to map memory via VFIO repeatedly triggers pin_user_pages_remote on zero-page addresses; the leaked references accumulate until a reference count overflow occurs, potentially leading to memory corruption or system crash.

How to fix it

Upgrade the Linux kernel to a fixed version: Debian 11 users to 5.10.148-1 or later; Debian 12 and 13 users to 5.19.11-1 or later. Reboot after installing the updated kernel package.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the listed fixed package; confirm absence of the reference-count-leak code path by inspecting the vfio/type1.c source or changelog entries for the unpin zero page change.

Typical attack path

1. Obtain capability to perform VFIO mappings (local user or compromised guest).
2. Repeatedly call operations that invoke pin_user_pages_remote on zero-page virtual addresses.
3. Accumulate unmapped references until the zero-page refcount overflows.
4. Trigger subsequent operations that rely on the corrupted reference count to cause instability or corruption.

How to detect it

Review kernel logs for repeated VFIO pin operations or reference count warnings; look for processes making unusually high numbers of user-page pin calls via strace or eBPF; examine audit logs for VFIO ioctl activity from non-privileged users.

What your security team should do

• Prioritize kernel upgrades on all systems exposing VFIO to untrusted users or VMs.
• Restrict VFIO device assignment to trusted workloads only until patches are applied.
• Monitor kernel update channels for backports to older LTS releases still in use.