CVE-2022-49002

What it actually does

Missing pci_dev_put() call on error path in for_each_pci_dev() loop inside dmar_dev_scope_init() causes PCI device reference count leak.

Why it matters to the business

Prolonged resource leaks in kernel initialization paths can lead to gradual memory exhaustion, system instability, and unplanned downtime; low exploitation likelihood reduces immediate urgency despite widespread Linux kernel presence.

How an attack unfolds

An attacker with local access or ability to influence IOMMU device enumeration triggers the error path during dmar_dev_scope_init(), leaving a PCI device reference held and enabling follow-on resource exhaustion or use-after-free attempts in subsequent kernel operations.

How to fix it

Apply the upstream fix by updating the Linux kernel to include the pci_dev_put() call on the error path in dmar_dev_scope_init(); for affected authzed/spicedb deployments, upgrade to commit 2f3cf77a7fcfcb478ef5a480a245842c96ac8853 or later.

How to confirm the fix worked

Confirm kernel source contains the added pci_dev_put() after breaking the for_each_pci_dev() loop; verify no reference count warnings in dmesg during IOMMU initialization on patched systems.

Typical attack path

1. Obtain local code execution or kernel module load capability on target system
2. Force IOMMU VT-d initialization error condition during device scope parsing
3. Trigger repeated enumeration loops to accumulate leaked references
4. Escalate via resulting memory corruption or denial of service

How to detect it

Review dmesg and kernel logs for repeated PCI device enumeration warnings or reference count imbalance messages around IOMMU initialization; inspect boot logs for VT-d DMAR scope errors on unpatched kernels.

What your security team should do

• Prioritize kernel updates on systems using Intel VT-d IOMMU within 30 days
• Monitor EPSS and threat actor reports for any rise in in-the-wild exploitation
• Audit custom kernel modules or boot configurations that may interact with dmar_dev_scope_init()