CVE-2022-48764

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for x86 architectures. A local user with privileges to manage virtual machines can cause a Denial of Service (DoS) by repeatedly issuing CPU feature configuration requests after running a virtual machine. Because the kernel fails to properly release allocated memory upon successful requests, this issue creates a memory leak that can deplete host system resources.

This vulnerability is rated as having a Low impact because exploitation requires existing local privileges to interact with KVM virtual machine instances, limiting the risk to controlled hypervisor environments rather than unauthenticated or remote users. In standard Red Hat Enterprise Linux deployments, access to virtualization device interfaces is restricted to authorized administrative users and dedicated hypervisor processes. An attacker must possess permission to repeatedly invoke configuration calls on an already running guest vCPU, causing unreleased memory on the host and gradual resource exhaustion. The flaw does not permit guest-to-host privilege escalation or compromise host confidentiality and data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.