CVE-2022-49011

What it actually does

Refcount leak on PCI device obtained via pci_get_domain_bus_and_slot in the hwmon coretemp driver's nv1a_ram_new function, leaving an extra reference that is never released.

Why it matters to the business

Gradual resource exhaustion on Linux systems that repeatedly exercise the affected hwmon code path, potentially causing driver instability or requiring reboots in long-running environments with high downstream kernel usage.

How an attack unfolds

An attacker with local access or the ability to trigger hardware monitoring code paths can repeatedly invoke the nv1a_ram_new function; each call leaks a PCI device reference without a corresponding pci_dev_put, allowing an attacker to slowly deplete kernel resources or combine with other kernel bugs for more severe impact. Listed threat actors have targeted similar Linux kernel resource-handling issues in espionage and financially motivated campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit bb75a0d1223d43f97089841aecb28a9b4de687a9 or later; for affected GitLab environments apply the corresponding fix at commit 91146650fd2d7d080662a536b1d04a5c96f451be.

How to confirm the fix worked

Confirm the presence of the fixing commit in the running kernel source or package; inspect dmesg or kernel logs for refcount warnings after exercising hwmon interfaces; verify pci_dev_put calls appear after pci_get_domain_bus_and_slot usage in coretemp code.

Typical attack path

1. Obtain local execution or trigger hardware monitoring via user-space interfaces
2. Repeatedly exercise the nv1a_ram_new code path to accumulate leaked PCI device references
3. Combine with other memory corruption primitives to convert the leak into a use-after-free or denial of service
4. Achieve privilege escalation or system instability

How to detect it

Review kernel logs for repeated PCI device allocation without matching release messages; look for unusual growth in PCI reference counts via /proc or debugfs; correlate with process activity that accesses coretemp or hwmon sysfs entries.

What your security team should do

• Prioritize kernel updates on all Linux systems within the published remediation window
• Monitor EPSS and threat actor activity for any increase in exploitation of similar resource-leak patterns
• Audit downstream dependents for custom hwmon or PCI-handling code that may contain analogous leaks
• Enable kernel hardening features such as refcount tracking and memory debugging to surface leaks earlier