CVE-2022-49546 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2022-49546?

CVE-2022-49546 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's kexec subsystem on x86_64 systems. When kdump kernel is reloaded or unloaded, an ELF header buffer allocated via vmalloc() is not properly freed, causing a gradual memory exhaustion. This affects systems using kexec/kdump functionality for crash recovery or kernel updates.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's kexec subsystem on x86_64 systems. When kdump kernel is reloaded or unloaded, an ELF header buffer allocated via vmalloc() is not properly freed, causing a gradual memory exhaustion. This affects systems using kexec/kdump functionality for crash recovery or kernel updates.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist for multiple stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when kexec/kdump functionality is enabled and used. Requires appropriate privileges to execute kexec operations.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Repeated exploitation could lead to complete system memory exhaustion, causing kernel panic, system crashes, or denial of service on critical systems.

🟠

Likely Case

Gradual memory depletion over time when kexec/kdump is used frequently, potentially causing performance degradation or application failures.

🟢

If Mitigated

Minimal impact if kexec/kdump is not used or if memory monitoring detects unusual consumption patterns.

🌐 Internet-Facing: LOW - This vulnerability requires local access and specific kexec operations to trigger.

🏢 Internal Only: MEDIUM - Internal users with appropriate privileges could exploit this to cause system instability or denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to execute kexec operations. Memory leak occurs gradually with repeated operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes: 115ee42a4c2f26ba2b4ace2668a3f004621f6833, 23cf39dccf7653650701a6f39b119e9116a27f1a, 8765a423a87d74ef24ea02b43b2728fe4039f248, b3e34a47f98974d0844444c5121aaff123004e57, f675e3a9189d84a9324ab45b0cb19906c2bc8fcb

Vendor Advisory: https://git.kernel.org/stable/c/115ee42a4c2f26ba2b4ace2668a3f004621f6833

Restart Required: Yes

Instructions:

1. Check current kernel version. 2. Update to patched kernel version from your distribution's repositories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable kexec/kdump

linux

Prevent exploitation by disabling kexec and kdump functionality

echo 0 > /proc/sys/kernel/kexec_load_disabled
systemctl disable kdump.service
systemctl stop kdump.service

Restrict kexec permissions

linux

Limit which users can execute kexec operations

chmod 750 /usr/sbin/kexec
setcap cap_sys_resource+ep /usr/sbin/kexec

🧯 If You Can't Patch

Disable kexec/kdump functionality if not required for operations
Implement memory monitoring to detect unusual consumption patterns and alert on potential exploitation

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if kexec is enabled: cat /proc/sys/kernel/kexec_load_disabled (0 means enabled)

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to patched version and test kexec functionality while monitoring memory usage

📡 Detection & Monitoring

Log Indicators:

Repeated kexec operations in system logs
Increasing memory usage without corresponding application growth
Kernel oom-killer events

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("kexec" OR "kdump") AND event_count > threshold

📊 Metadata

CVE ID: CVE-2022-49546

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.03% exploit probability (7.6th percentile)

Published: February 26, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49546, you might also want to check these: