CVE-2022-49000

What it actually does

Missing pci_dev_put() call after early break from for_each_pci_dev() loop in has_external_pci() causes PCI device reference count leak.

Why it matters to the business

Kernel memory accounting errors on Linux systems using Intel IOMMU VT-d can lead to gradual resource leaks, potential instability, or crashes under sustained load; widespread Linux kernel usage increases exposure across servers and devices.

How an attack unfolds

An attacker with local access or ability to influence PCI device enumeration triggers the has_external_pci() path, causing repeated reference count leaks without corresponding decrements, potentially enabling later memory corruption or denial of service; listed espionage and financially motivated actors have shown interest in similar Linux kernel resource issues.

How to fix it

Upgrade the Linux kernel to a version containing commit 10ed7655a17f6a3eaecd1293830488259ccd5723 or later stable releases that include the pci_dev_put() fix.

How to confirm the fix worked

Confirm kernel source contains the pci_dev_put() call before the 'return true' in has_external_pci() and verify the running kernel version matches a fixed release.

Typical attack path

1. Obtain local code execution or kernel module loading capability
2. Trigger IOMMU VT-d initialization or PCI device scanning that calls has_external_pci()
3. Force early loop exit leaving reference count unbalanced
4. Repeat to accumulate leak until kernel memory pressure or instability occurs

How to detect it

Review kernel logs for repeated IOMMU or PCI enumeration warnings; inspect for unusual memory growth in processes interacting with VT-d; correlate with threat actor activity around Linux kernel resource vulnerabilities.

What your security team should do

• Prioritize kernel upgrades on all affected Linux systems within standard patch cycles given low EPSS and lack of KEV listing
• Monitor for future Linux kernel resource handling CVEs due to prevalence of the codebase
• Apply the specific commit 10ed7655a17f6a3eaecd1293830488259ccd5723 where backports are required