CVE-2022-49965: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49965 is a memory leak vulnerability in the Linux kernel's AMD power management (drm/amd/pm) module, caused by missing ->fini_xxxx finalization interfaces for certain SMU13 ASIC devices. It affects Linux kernel versions 5.19 through 5.19.6 and 6.0-rc1. The vulnerability was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium), requiring local low-privileged access with no user interaction (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The AMD SMU13 (System Management Unit) power management code in the DRM subsystem lacks the necessary finalization (->fini_xxxx) interface implementations, meaning allocated memory is never freed when the relevant ASIC devices are torn down or the module is unloaded. Exploitation requires local access with low privileges, as an attacker would need to trigger the relevant code paths on a system with an affected AMD GPU. Patches addressing the issue are available in the stable kernel tree (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation can lead to resource exhaustion through memory leaks in the kernel's AMD power management subsystem, potentially causing system instability or denial-of-service conditions. The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning attackers cannot directly access or modify data but can degrade or disrupt system operation. Systems running affected AMD GPU hardware with SMU13 ASICs are at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is extremely low at 0.018%, reflecting minimal likelihood of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has detection coverage for this CVE (Feedly).

Update the Linux kernel to version 5.19.7 or later, which includes the fix for the missing finalization interfaces in the AMD SMU13 power management module. For systems running 6.0-rc1, apply the relevant stable kernel patches (Kernel Patch 1, Kernel Patch 2). As a supplementary measure, implement strict local access controls to limit low-privileged user access, and monitor system memory usage for anomalies on hosts with affected AMD GPU hardware. SUSE has also issued kernel security advisories addressing this CVE (Linux Security SUSE).

SUSE issued security advisories covering CVE-2022-49965 as part of broader Linux kernel update packages, rated as important (Linux Security SUSE). No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.