CVE-2022-50505

A reference counting violation was found in the Linux kernel's AMD IOMMU PPR (Peripheral Page Request) notification handler. When the handler looks up PCI devices using pci_get_domain_bus_and_slot, it receives a reference-counted device pointer but never releases that reference before returning. This creates permanent reference leaks that prevent proper device cleanup, eventually exhausting system resources and causing denial of service.

The PPR notifier handles page fault requests from IOMMU-managed devices. As documented in the PCI subsystem, pci_get_domain_bus_and_slot increments the reference count on the returned device—this is intentional, ensuring the device doesn't disappear while being used. The caller's responsibility is to decrement that count via pci_dev_put when finished. The ppr_notifier function calls pci_get_domain_bus_and_slot to locate the faulting device, processes the fault, then returns without ever calling pci_dev_put. Each invocation therefore leaks one reference. Over time, these leaked references accumulate on the affected devices. Once a device has outstanding references, the system cannot fully release it even when physically removed or when the driver unloads. Eventually this can exhaust kernel object limits or create situations where stale device objects persist indefinitely. The issue affects AMD IOMMU systems when PPR is enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.