{"schema_version":"1.9.0","id":"CVE-2022-49436","published":"2025-02-26T02:12:52.044Z","modified":"2026-08-12T03:51:17.373204673Z","related":["SUSE-SU-2025:1176-1","SUSE-SU-2025:1241-1"],"summary":"powerpc/papr_scm: Fix leaking nvdimm_events_map elements","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/papr_scm: Fix leaking nvdimm_events_map elements\n\nRight now 'char *' elements allocated for individual 'stat_id' in\n'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get\nleaked in papr_scm_remove() and papr_scm_pmu_register(),\npapr_scm_pmu_check_events() error paths.\n\nAlso individual 'stat_id' arent NULL terminated 'char *' instead they are fixed\n8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a\nNULL terminated 'char *' and at other places it assumes it to be a\n'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size.\n\nFix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also\ninclude space for 'stat_id' entries. This is possible since number of available\nevents/stat_ids are known upfront. This saves some memory and one extra level of\nindirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code\ncan continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to\niterate over the array and free up individual elements.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b"},{"fixed":"b073096df4dec70d0436321b7093bad27ae91f9e"},{"fixed":"0e0946e22f3665d27325d389ff45ade6e93f3678"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49436.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.0"},{"fixed":"5.18.3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49436.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49436.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49436"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49436.json"}}