---
id: CVE-2022-49436
title: 'powerpc/papr_scm: Fix leaking nvdimm_events_map elements'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  powerpc/papr_scm: Fix leaking nvdimm_events_map elements

  Right now 'char *' elements allocated for individual 'stat_id' in
  'papr_scm_priv.nvdimm_events_map[]' during p…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b <
    b073096df4dec70d0436321b7093bad27ae91f9e
  - >-
    Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b <
    0e0946e22f3665d27325d389ff45ade6e93f3678
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:45:34.397056Z'
published: '2025-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:39.644Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49436'
references:
  - url: 'https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e'
  - url: 'https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678'
tags:
  - cve.org
epss: 0.00222
epssPercentile: 0.12901
ingestedAt: '2026-11-05T22:38:31.573Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

powerpc/papr_scm: Fix leaking nvdimm_events_map elements

Right now 'char *' elements allocated for individual 'stat_id' in
'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get
leaked in papr_scm_remove() and papr_scm_pmu_register(),
papr_scm_pmu_check_events() error paths.

Also individual 'stat_id' arent NULL terminated 'char *' instead they are fixed
8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a
NULL terminated 'char *' and at other places it assumes it to be a
'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size.

Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also
include space for 'stat_id' entries. This is possible since number of available
events/stat_ids are known upfront. This saves some memory and one extra level of
indirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code
can continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to
iterate over the array and free up individual elements.

## Affected

- `Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b < b073096df4dec70d0436321b7093bad27ae91f9e`
- `Linux >= 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b < 0e0946e22f3665d27325d389ff45ade6e93f3678`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.