CVE-2022-49966: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49966 is a memory leak vulnerability in the Linux kernel's AMD power management (drm/amd/pm) module, caused by a missing ->fini_microcode interface for the Sienna Cichlid GPU. The flaw was published on June 18, 2025, and affects Linux kernel versions 5.9 through 5.10.141, 5.11 through 5.15.65, 5.16 through 5.19.7, and 6.0-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local low-privilege access to trigger (Feedly, CIRCL).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The drm/amd/pm subsystem for the Sienna Cichlid GPU (AMD RX 6000 series) lacks a ->fini_microcode teardown callback, meaning microcode-related memory allocated during initialization is never freed when the module is unloaded or the device is finalized. An attacker or unprivileged local user can trigger this path to cause a kernel memory leak. The fix adds the missing interface to ensure proper memory cleanup (Feedly, kernel.org patch).

Successful exploitation results in a high availability impact — a local low-privilege attacker can cause progressive kernel memory exhaustion, potentially leading to system instability, performance degradation, or denial of service. There is no confidentiality or integrity impact, and the scope is limited to the affected host. Lateral movement is not a direct consequence of this vulnerability (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

Patches are available for all affected kernel stable branches: versions prior to 5.10.141, 5.15.65, and 5.19.7 should be updated to their respective fixed releases. Four upstream kernel commits address the issue (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3, kernel.org patch 4). SUSE has also issued updated kernel packages addressing this CVE. As a short-term workaround, restricting local user privileges and monitoring system memory consumption for unusual growth can reduce risk until patching is feasible (SUSE Advisory).

SUSE issued multiple kernel security advisories (SUSE-2025-02264-1 and SUSE-2025-02537-1) that include fixes for CVE-2022-49966 among other kernel vulnerabilities. Coverage has been limited to vendor advisory aggregators and Linux security news sites, with no notable independent researcher commentary or significant social media discussion observed (SUSE Advisory, Linux Compatible).