CVE-2022-49011

A counting logic flaw exists in the Linux kernel. When ci_get_domain_bus_and_slot() is called, it returns a pci device with refcount incremented. When finishing it, the caller must decrement the reference count by calling pci_dev_put(), leading to the loss of confidentiality of the system.

This issue is fixed in RHEL-9.4 and above:

in (rhel-9.4, rhel-9.5, rhel-9.6) hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.