CVE-2022-48724

What it actually does

Potential memory leak of firmware node (fn) plus missing removal of irq_domain and ir_msi_domain in intel_setup_irq_remapping() when dmar_enable_qi fails after the firmware node has already been allocated.

Why it matters to the business

On systems using Intel VT-d with IRQ remapping, repeated error paths during IOMMU initialization can cause gradual kernel memory exhaustion, leading to performance degradation or crashes in widely deployed Linux environments.

How an attack unfolds

An attacker with the ability to induce failure of dmar_enable_qi during IRQ remapping setup (for example through specific hardware or configuration conditions) can trigger the incomplete cleanup path, resulting in resource leaks. No public exploitation or named threat actors are associated with this issue.

How to fix it

Upgrade the Linux kernel to commit bcf876870b95592b52519ed4aafcf9d95999bc9c or any later mainline or distribution release that contains the added out_free_ir_domain and out_free_fwnode cleanup labels.

How to confirm the fix worked

Inspect the intel_setup_irq_remapping function in the running kernel source or binary for the presence of the two new goto labels that free fn, irq_domain, and ir_msi_domain on the dmar_enable_qi error path.

Typical attack path

1. Cause intel_setup_irq_remapping to reach the point where fn is allocated
2. Force dmar_enable_qi to return an error
3. Observe that fn, irq_domain, and ir_msi_domain are not released
4. Repeat the sequence to accumulate unreclaimed memory

How to detect it

Search kernel logs for repeated intel_setup_irq_remapping and dmar_enable_qi error messages together with unexplained growth in slab or kernel memory usage on Intel VT-d platforms.

What your security team should do

• Apply the referenced kernel commit or a distribution backport at the next maintenance window
• Prioritize systems that enable Intel IOMMU IRQ remapping
• Verify the fix is present after reboot by checking kernel version or source
• Monitor kernel memory usage on affected hosts until patched