CVE-2022-49893: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49893 is a vulnerability discovered in the Linux kernel's CXL (Compute Express Link) region functionality. The vulnerability was disclosed on May 1, 2025, affecting the cxl/region component of the Linux kernel (NVD, Wiz).

The vulnerability stems from a reference handling issue in the cxl_region component. When a region is deleted, any targets that were previously assigned to that region continue to hold references to it. Since userspace loses the ability to detach targets once the region sysfs is torn down, this results in a memory leak condition. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 by Red Hat (Red Hat).

The primary impact of this vulnerability is a memory leak in the Linux kernel's CXL subsystem. This could potentially lead to resource exhaustion over time if exploited (Wiz).

The vulnerability has been addressed through a fix that ensures targets are detached at unregister_region() time, which triggers the references to drop properly. This prevents the region object from leaking after deletion. The fix has been deferred for Red Hat Enterprise Linux 9 (Red Hat).