CVE-2022-50738 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
vhost-vdpa: fix an iotlb memory leak
Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free all the resources allocated when processing user IOTLB messages through vhost_vdpa_process_iotlb_update(). That commit changed the handling of IOTLB a bit, and we accidentally removed some code called during the release.
We partially fixed this with commit 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") but a potential memory leak is still there as showed by kmemleak if the application does not send VHOST_IOTLB_INVALIDATE or crashes:
unreferenced object 0xffff888007fbaa30 (size 16): comm "blkio-bench", pid 914, jiffies 4294993521 (age 885.500s) hex dump (first 16 bytes): 40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00 @sA............. backtrace: [<0000000087736d2a>] kmem_cache_alloc_trace+0x142/0x1c0
[<0000000060740f50>] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa]
[<0000000083e8e205>] vhost_chr_write_iter+0xc0/0x4a0 [vhost]
[<000000008f2f414a>] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa]
[<00000000de1cd4a0>] vfs_write+0x216/0x4b0
[<00000000a2850200>] ksys_write+0x71/0xf0
[<00000000de8e720b>] __x64_sys_write+0x19/0x20
[<0000000018b12cbb>] do_syscall_64+0x3f/0x90
[<00000000986ec465>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Let's fix this calling vhost_vdpa_iotlb_unmap() on the whole range in vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup() since we need a valid v->vdev.mm in vhost_vdpa_pa_unmap(). vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap() on the whole range removes all the entries.
The kmemleak log reported was observed with a vDPA device that has `use_va` set to true (e.g. VDUSE). This patch has been tested with both types of devices.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability CVE-2022-50738 represents a memory leak in the Linux kernel's vhost-vdpa subsystem that occurs during device cleanup operations. This issue specifically affects virtualized I/O devices that utilize vDPA (virtual data path acceleration) functionality, particularly those with `use_va` set to true such as VDUSE devices. The problem stems from an incomplete cleanup routine that fails to properly release IOTLB (I/O Translation Lookaside Buffer) memory resources when vhost-vdpa devices are removed or terminated. This memory leak manifests as unreferenced objects that persist in kernel memory, potentially leading to resource exhaustion over time.
The technical flaw originates from changes made in commit 3d5698793897 which introduced ASID-based IOTLB handling, inadvertently removing critical cleanup code that was previously responsible for freeing all IOTLB resources during device release. Although a partial fix was implemented in commit 037d4305569a, it proved insufficient as demonstrated by kmemleak analysis showing persistent memory allocations. The memory leak occurs when applications do not explicitly send VHOST_IOTLB_INVALIDATE commands or when processes crash, leaving IOTLB entries in an unreleased state. The backtrace from the kmemleak report shows the allocation path through vhost_vdpa_process_iotlb_msg, indicating that IOTLB entries are allocated but never properly freed during cleanup.
The operational impact of this vulnerability extends beyond simple memory consumption, as it can lead to progressive system resource degradation and potential denial of service conditions. When multiple vhost-vdpa devices are created and destroyed repeatedly, or when applications crash without proper cleanup, the accumulated memory leaks can consume significant kernel memory resources. This particularly affects high-performance virtualized environments where vDPA devices are frequently used for storage I/O operations, such as in block I/O benchmarks or virtual machine workloads. The vulnerability affects systems running Linux kernels that include the problematic vhost-vdpa code changes, making it relevant to virtualization platforms and cloud environments that utilize vDPA acceleration.
The mitigation strategy implemented in the fix involves calling vhost_vdpa_iotlb_unmap() on the entire IOTLB range within vhost_vdpa_remove_as() before invoking vhost_dev_cleanup(). This ensures that all IOTLB entries are properly released regardless of whether the application sent explicit invalidation commands or if the process terminated abruptly. The fix also removes the vhost_iotlb_reset() call since the comprehensive unmap operation already handles complete entry removal. The solution addresses the core issue by ensuring proper memory management in the device removal path, moving the cleanup operation to occur before the device cleanup routine that would otherwise invalidate the necessary memory management context. This approach aligns with CWE-404, which addresses improper resource release, and follows ATT&CK technique T1490 for resource exhaustion through memory leaks. The fix has been tested across both VDUSE and non-VdUSE devices to ensure compatibility and effectiveness across different vDPA implementations.