What is CVE-2022-48764?

CVE-2022-48764 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.3 out of 10, classified as a Memory Leak flaw (CWE-401), affecting Linux kernel versions from 5.16.3 onward and patched in 5.16.5. CVE-2022-48764 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2022-48764?

CVE-2022-48764 has a CVSS score of 5.3 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Is there a patch available for CVE-2022-48764?

Yes, CVE-2022-48764 has been patched. Fixed versions include 5.16.5. If you are running Linux kernel 5.16.3 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2022-48764 actively exploited?

CVE-2022-48764 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Memory Leak (CWE-401)?

The product does not release memory after use, causing gradual resource exhaustion. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/401.html

CVE-2022-48764

Medium

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2} Free the "struct kvm_cpuid_entry2" array on successful post-KVM_RUN KVM_SET_CPUID{,2} to fix a memory leak, the callers of kvm_set_cpuid() free the array only on failure. BUG: memory leak unreferenced object 0xffff88810963a800 (size 2048): comm "syz-executor025", pid 3610, jiffies 4294944928 (age 8.080s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 ................ 47 65 6e 75 6e 74 65 6c 69 6e 65 49 00 00 00 00 GenuntelineI.... backtrace: [<ffffffff814948ee>] kmalloc_node include/linux/slab.h:604 [inline] [<ffffffff814948ee>] kvmalloc_node+0x3e/0x100 mm/util.c:580 [<ffffffff814950f2>] kvmalloc include/linux/slab.h:732 [inline] [<ffffffff814950f2>] vmemdup_user+0x22/0x100 mm/util.c:199 [<ffffffff8109f5ff>] kvm_vcpu_ioctl_set_cpuid2+0x8f/0xf0 arch/x86/kvm/cpuid.c:423 [<ffffffff810711b9>] kvm_arch_vcpu_ioctl+0xb99/0x1e60 arch/x86/kvm/x86.c:5251 [<ffffffff8103e92d>] kvm_vcpu_ioctl+0x4ad/0x950 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4066 [<ffffffff815afacc>] vfs_ioctl fs/ioctl.c:51 [inline] [<ffffffff815afacc>] __do_sys_ioctl fs/ioctl.c:874 [inline] [<ffffffff815afacc>] __se_sys_ioctl fs/ioctl.c:860 [inline] [<ffffffff815afacc>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 [<ffffffff844a3335>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff844a3335>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Package Linux Kernel

Published 2024-06-20

Last modified 2025-03-24

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.3

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness type

CWE-401

CVE-2022-48764 is a Memory Leak vulnerability

What is Memory Leak?

The product does not release memory after use, causing gradual resource exhaustion. Learn more on MITRE CWE

Affected versions

Linux kernel versions 5.16.3 and later are affected. Fixed in 5.16.5 and their respective stable series.

Affected from

≥ 5.16.3

Fixed in

✓ 5.16.5 5.16.x

References

2 total

Kernel Git
https://git.kernel.org/stable/c/811f95ff95270e6048197821434d9301e3d7f07c

Patch
Kernel Git
https://git.kernel.org/stable/c/b9ee734a14bb685b2088f2176d82b34cb4e30dbc

Patch

Details

CVE ID CVE-2022-48764

Severity Medium

CVSS score 5.3 / 10

CVSS version 3.1

Published 2024-06-20

Modified 2025-03-24

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2022-48764?

CVE-2022-48764 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.3 out of 10 , classified as a Memory Leak flaw (CWE-401) . It affects Linux kernel versions from 5.16.3 onward and has been patched in 5.16.5. CVE-2022-48764 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2022-48764?

CVE-2022-48764 has a CVSS score of 5.3 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Is there a patch available for CVE-2022-48764?

Yes. CVE-2022-48764 has been patched. Fixed versions include 5.16.5. If you are running Linux kernel 5.16.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2022-48764 actively exploited?

No. CVE-2022-48764 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.