CVE-2022-49027

What it actually does

Resource leak in iavf_init_module() when pci_register_driver() fails, as destroy_workqueue() is not called, leaving the workqueue allocated.

Why it matters to the business

Potential gradual resource exhaustion on systems using the iavf driver, increasing operational overhead in large fleets; low urgency due to age, stable low EPSS, and absence from KEV or ransomware campaigns despite listed threat actor references.

How an attack unfolds

An attacker would attempt to induce pci_register_driver failure during iavf module initialization to trigger the leak; referenced threat actors in 2024 zero-day and Linux kernel resource vulnerability campaigns have not produced public exploits for this specific path.

How to fix it

Apply the fix from commit 971c55f0763b480e63ceb7a22beb19be2509e5ed in the Linux kernel stable repository; upgrade to a kernel version containing this commit.

How to confirm the fix worked

Inspect iavf_init_module source to confirm destroy_workqueue is invoked on pci_register_driver failure; test module load under simulated failure conditions and verify no workqueue leak via kernel memory tools.

Typical attack path

1. Load or trigger initialization of the iavf module under conditions causing pci_register_driver to fail
2. Workqueue remains allocated due to missing destroy_workqueue call
3. Repeat to accumulate leaked resources

How to detect it

Examine kernel logs and dmesg for iavf module load failures; use memory leak detection tools to identify orphaned workqueues; correlate with referenced Linux kernel resource vulnerability patterns from threat actor activity.

What your security team should do

• Prioritize kernel upgrades containing commit 971c55f0763b480e63ceb7a22beb19be2509e5ed across affected systems
• Monitor ecosystem prevalence of downstream dependents for broader rollout urgency
• Review kernel logs for iavf initialization anomalies as part of routine hardening