{
  "cveId": "CVE-2022-48764",
  "url": "https://patchblox.com/security/cve/CVE-2022-48764",
  "summary": "CVE-2022-48764 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48764, released June 20, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Free kvm_cpuid_entry2 array on post-KV...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2}  Free the \u0022struct kvm_cpuid_entry2\u0022 array on successful post-KVM_RUN KVM_SET_CPUID{,2} to fix a memory leak, the callers of kvm_set_cpuid() free the array only on failure.   BUG: memory leak  unreferenced object 0xffff88810963a800 (size 2048):   comm \u0022syz-executor025\u0022, pid 3610, jiffies 4294944928 (age 8.080s)   hex dump (first 32 bytes):     00 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00  ................     47 65 6e 75 6e 74 65 6c 69 6e 65 49 00 00 00 00  GenuntelineI....   backtrace:     [\u003Cffffffff814948ee\u003E] kmalloc_node include/linux/slab.h:604 [inline]     [\u003Cffffffff814948ee\u003E] kvmalloc_node\u002B0x3e/0x100 mm/util.c:580     [\u003Cffffffff814950f2\u003E] kvmalloc include/linux/slab.h:732 [inline]     [\u003Cffffffff814950f2\u003E] vmemdup_user\u002B0x22/0x100 mm/util.c:199     [\u003Cffffffff8109f5ff\u003E] kvm_vcpu_ioctl_set_cpuid2\u002B0x8f/0xf0 arch/x86/kvm/cpuid.c:423     [\u003Cffffffff810711b9\u003E] kvm_arch_vcpu_ioctl\u002B0xb99/0x1e60 arch/x86/kvm/x86.c:5251     [\u003Cffffffff8103e92d\u003E] kvm_vcpu_ioctl\u002B0x4ad/0x950 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4066     [\u003Cffffffff815afacc\u003E] vfs_ioctl fs/ioctl.c:51 [inline]     [\u003Cffffffff815afacc\u003E] __do_sys_ioctl fs/ioctl.c:874 [inline]     [\u003Cffffffff815afacc\u003E] __se_sys_ioctl fs/ioctl.c:860 [inline]     [\u003Cffffffff815afacc\u003E] __x64_sys_ioctl\u002B0xfc/0x140 fs/ioctl.c:860     [\u003Cffffffff844a3335\u003E] do_syscall_x64 arch/x86/entry/common.c:50 [inline]     [\u003Cffffffff844a3335\u003E] do_syscall_64\u002B0x35/0xb0 arch/x86/entry/common.c:80     [\u003Cffffffff84600068\u003E] entry_SYSCALL_64_after_hwframe\u002B0x44/0xae",
  "published": "2024-06-20T12:15:14Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "epss": 0.00179,
  "epssPercentile": 0.07488,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.16.7-1",
      "fix": "DEBIAN-CVE-2022-48764",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48764",
      "released": "2024-06-20T12:15:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.16.7-1",
      "fix": "DEBIAN-CVE-2022-48764",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48764",
      "released": "2024-06-20T12:15:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.16.7-1",
      "fix": "DEBIAN-CVE-2022-48764",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-48764",
      "released": "2024-06-20T12:15:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}