{"id":"CVE-2022-49436","title":"powerpc/papr_scm: Fix leaking nvdimm_events_map elements","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/papr_scm: Fix leaking nvdimm_events_map elements\n\nRight now 'char *' elements allocated for individual 'stat_id' in\n'papr_scm_priv.nvdimm_events_map[]' during p…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b < b073096df4dec70d0436321b7093bad27ae91f9e","Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b < 0e0946e22f3665d27325d389ff45ade6e93f3678","Linux 5.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:45:34.397056Z"},"published":"2025-02-26","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:49:39.644Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49436","references":[{"url":"https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e"},{"url":"https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678"}],"tags":["cve.org"],"epss":0.00222,"epssPercentile":0.12901,"ingestedAt":"2026-11-05T22:38:31.573Z","slug":"CVE-2022-49436","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/papr_scm: Fix leaking nvdimm_events_map elements\n\nRight now 'char *' elements allocated for individual 'stat_id' in\n'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get\nleaked in papr_scm_remove() and papr_scm_pmu_register(),\npapr_scm_pmu_check_events() error paths.\n\nAlso individual 'stat_id' arent NULL terminated 'char *' instead they are fixed\n8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a\nNULL terminated 'char *' and at other places it assumes it to be a\n'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size.\n\nFix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also\ninclude space for 'stat_id' entries. This is possible since number of available\nevents/stat_ids are known upfront. This saves some memory and one extra level of\nindirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code\ncan continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to\niterate over the array and free up individual elements.\n\n## Affected\n\n- `Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b < b073096df4dec70d0436321b7093bad27ae91f9e`\n- `Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b < 0e0946e22f3665d27325d389ff45ade6e93f3678`\n- `Linux 5.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}