CVE-2022-49196

Summary

CVE-2022-49196: A vulnerability in the Linux kernel's powerpc/pseries driver affects the remove_phb_dynamic() function. This function attempts to use the io_resource pointer of a host bridge device after calling device_unregister(), which may have already freed the device due to a release function call. If no references remain when device_unregister() is called, a use-after-free condition arises, leading to a crash. To prevent this issue, developers should maintain a reference to the host_bridge->dev until they have finished using the phb, and release the reference only after they are done.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.