# CVE-2022-49196: linux: In the Linux kernel, the following vulnerability has been resolved:  powerpc/pseries: Fix use after free in remove_ph...

CVE-2022-49196 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49196, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-49196
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0028
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 26, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  powerpc/pseries: Fix use after free in remove_phb_dynamic()  In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge.  If there are no outstanding references when we call device_unregister() then phb will be freed out from under us.  This has gone mainly unnoticed, but with slub_debug and page_poison enabled it can lead to a crash:    PID: 7574   TASK: c0000000d492cb80  CPU: 13  COMMAND: "drmgr"    #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc    #1 [c0000000e4f075d0] oops_end at c000000000029608    #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4    #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8    #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30    Data SLB Access [380] exception frame:    R0:  c000000000167250    R1:  c0000000e4f07a00    R2:  c000000002a46100    R3:  c000000002b39ce8    R4:  00000000000000c0    R5:  00000000000000a9    R6:  3894674d000000c0    R7:  0000000000000000    R8:  00000000000000ff    R9:  0000000000000100    R10: 6b6b6b6b6b6b6b6b    R11: 0000000000008000    R12: c00000000023da80    R13: c0000009ffd38b00    R14: 0000000000000000    R15: 000000011c87f0f0    R16: 0000000000000006    R17: 0000000000000003    R18: 0000000000000002    R19: 0000000000000004    R20: 0000000000000005    R21: 000000011c87ede8    R22: 000000011c87c5a8    R23: 000000011c87d3a0    R24: 0000000000000000    R25: 0000000000000001    R26: c0000000e4f07cc8    R27: c00000004d1cc400    R28: c0080000031d00e8    R29: c00000004d23d800    R30: c00000004d1d2400    R31: c00000004d1d2540    NIP: c000000000167258    MSR: 8000000000009033    OR3: c000000000e9f474    CTR: 0000000000000000    LR:  c000000000167250    XER: 0000000020040003    CCR: 0000000024088420    MQ:  0000000000000000    DAR: 6b6b6b6b6b6b6ba3    DSISR: c0000000e4f07920     Syscall Result: fffffffffffffff2    [NIP  : release_resource+56]    [LR   : release_resource+48]    #5 [c0000000e4f07a00] release_resource at c000000000167258  (unreliable)    #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648    #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io]    #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io]    #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c   #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504   #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868   #12 [c0000000e4f07c70] new_sync_write at c00000000054339c   #13 [c0000000e4f07d10] vfs_write at c000000000546624   #14 [c0000000e4f07d60] ksys_write at c0000000005469f4   #15 [c0000000e4f07db0] system_call_exception at c000000000030840   #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168  To avoid it, we can take a reference to the host_bridge->dev until we're done using phb. Then when we drop the reference the phb will be freed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.17.3-1 | [DEBIAN-CVE-2022-49196](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49196.md) | Feb 26, 2025 |
| Linux | linux Debian 13.5 (trixie) | 5.17.3-1 | [DEBIAN-CVE-2022-49196](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49196.md) | Feb 26, 2025 |
| Linux | linux Debian 14 | 5.17.3-1 | [DEBIAN-CVE-2022-49196](https://patchblox.com/security/data/fix/linux/debian-cve-2022-49196.md) | Feb 26, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.