# CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

Status: published. Published: 2025-05-01. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:

  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121
   instrument_copy_to_user ./include/linux/instrumented.h:121
   _copy_to_user+0x5f/0xb0 lib/usercopy.c:33
   copy_to_user ./include/linux/uaccess.h:169
   vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431
   vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925
   vfs_ioctl fs/ioctl.c:51
  ...

  Uninit was stored to memory at:
   kmemdup+0x74/0xb0 mm/util.c:131
   dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271
   vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339
   qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
   vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940
   vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488
   vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927
  ...

  Local variable ev created at:
   qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750

  Bytes 28-31 of 48 are uninitialized
  Memory access of size 48 starts at ffff888035155e00
  Data copied to user address 0000000020000100

Use memset() to prevent the infoleaks.

Also speculatively fix qp_notify_peer_local(), which may suffer from the
same problem.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < 7ccf7229b96fadc3a185d1391f814a604c7ef609 (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < f04586c2315cfd03d72ad0395705435e7ed07b1a (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < 5a275528025ae4bc7e2232866856dfebf84b2fad (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < e7061dd1fef2dfb6458cd521aef27aa66f510d31 (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < 62634b43d3c4e1bf62fd540196f7081bf0885c0a (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < 8e2f33c598370bcf828bab4d667d1d38bcd3c57d (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < 76c50d77b928a33e5290aaa9fdc10e88254ff8c7 (affected, git); ≥ 06164d2b72aa752ce4633184b3e0d97601017135; < e5b0d06d9b10f5f43101bd6598b076c347f9295f (affected, git). Source: CNA: Linux
- Linux / Linux: 3.9 (affected); ≥ 0; < 3.9 (unaffected, semver); ≥ 4.9.334; ≤ 4.9.* (unaffected, semver); ≥ 4.14.300; ≤ 4.14.* (unaffected, semver); ≥ 4.19.267; ≤ 4.19.* (unaffected, semver); ≥ 5.4.225; ≤ 5.4.* (unaffected, semver); ≥ 5.10.156; ≤ 5.10.* (unaffected, semver); ≥ 5.15.80; ≤ 5.15.* (unaffected, semver); ≥ 6.0.10; ≤ 6.0.* (unaffected, semver); ≥ 6.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.23% as of 2026-11-05; percentile 14.41%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/7ccf7229b96fadc3a185d1391f814a604c7ef609 (CNA: Linux)

- https://git.kernel.org/stable/c/f04586c2315cfd03d72ad0395705435e7ed07b1a (CNA: Linux)

- https://git.kernel.org/stable/c/5a275528025ae4bc7e2232866856dfebf84b2fad (CNA: Linux)

- https://git.kernel.org/stable/c/e7061dd1fef2dfb6458cd521aef27aa66f510d31 (CNA: Linux)

- https://git.kernel.org/stable/c/62634b43d3c4e1bf62fd540196f7081bf0885c0a (CNA: Linux)

- https://git.kernel.org/stable/c/8e2f33c598370bcf828bab4d667d1d38bcd3c57d (CNA: Linux)

- https://git.kernel.org/stable/c/76c50d77b928a33e5290aaa9fdc10e88254ff8c7 (CNA: Linux)

- https://git.kernel.org/stable/c/e5b0d06d9b10f5f43101bd6598b076c347f9295f (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-49788; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-49788; retrieved 2026-11-05; source updated Not reported

Revision: a7a71dcccdbb5c6913d61d530d9bc3127b71e03392510f577c2a03fe68b51a30

Canonical: https://y2.dev/cve/CVE-2022-49788

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.