CVE-2022-48764

What it actually does

Memory leak of kvm_cpuid_entry2 arrays in KVM x86 CPUID handling: the array is allocated via vmemdup_user on KVM_SET_CPUID2 but only freed on failure paths, not on successful post-KVM_RUN calls.

Why it matters to the business

Gradual memory exhaustion on hypervisors can degrade VM density, trigger OOM kills, or cause host instability in long-running or high-churn virtualization environments; urgency is low given absent exploitation and low EPSS.

How an attack unfolds

An attacker with the ability to issue KVM ioctls (typically from a guest or compromised userspace) performs KVM_RUN followed by repeated successful KVM_SET_CPUID2 calls; each call allocates a new array that is never freed, accumulating unreferenced kernel memory.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit b9ee734a14bb685b2088f2176d82b34cb4e30dbc or release 5.16.5 or later; apply vendor backports for supported stable branches.

How to confirm the fix worked

Confirm kernel version includes the referenced commit or is at least 5.16.5; enable kernel memory leak detectors (kmemleak) and verify no unreferenced kvm_cpuid_entry2 objects after KVM_SET_CPUID2 operations.

Typical attack path

1. Obtain privileges to open /dev/kvm and control a vCPU (guest access or container escape)
2. Issue KVM_RUN on the vCPU
3. Issue KVM_SET_CPUID2 (or KVM_SET_CPUID) with valid data
4. Repeat the sequence to trigger repeated allocations without corresponding frees

How to detect it

Use kernel memory debugging (kmemleak, KASAN) to detect unreferenced kvm_cpuid_entry2 allocations; inspect logs for repeated kvm_vcpu_ioctl_set_cpuid2 calls followed by growing slab usage; correlate with process names invoking KVM ioctls.

What your security team should do

• Patch hypervisor hosts to a fixed kernel within normal change windows given low exploit maturity
• Monitor memory usage trends on KVM hosts for unexpected growth correlated with vCPU ioctl activity
• Limit untrusted guest access to raw KVM ioctls where feasible