What’s Vulnerable › Vulnerabilities

CVE-2022-50263: vdpasim: fix memory leak when freeing IOTLBs

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-15 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: vdpasim: fix memory leak when freeing IOTLBs After commit bda324fd037a ("vdpasim: control virtqueue support"), vdpasim->iommu became an array of IOTLB, so we should clean the mappings of each free one by one instead of just deleting the ranges in the first IOTLB which may leak maps.

Affected products

• Linux kernel: from 5.19 before 6.0.19; from 6.1 before 6.1.5; 6.2-rc1, 6.2-rc2 — fixed in 6.0.19, 6.1.5

How to fix

Upgrade to a fixed version: Linux kernel 6.0.19, 6.1.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0b7a04a30eef20e6b24926a45c0ce7906ae85bd6
• https://git.kernel.org/stable/c/16b22e27fba6fd816d0dcb98f42cc71f0836c27e
• https://git.kernel.org/stable/c/54b210c90d2803a9f1c8fd2f0d08e90172e9a06d

Get alerted when CVE-2022-50263 or the next vulnerability affects your stack