CVE-2022-50281
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-12-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.5 (inc) to 5.10.150 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.75 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 5.19.17 (exc) |
| linux | linux_kernel | From 6.0 (inc) to 6.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a resource leak in the Linux kernel on the MIPS SGI-IP27 platform. Specifically, in the function bridge_platform_create(), if an error occurs after calling platform_device_add(), platform_device_add_data(), or platform_device_add_resources(), the platform device ('pdev') is not properly released, causing a leak. The fix involves calling platform_device_put() to release the failed 'pdev'. Additionally, 'pdev' is split into 'pdev_wd' and 'pdev_bd', and platform_device_unregister() is used to release sgi_w1 resources if xtalk-bridge registration fails.
How can this vulnerability impact me? :
This vulnerability can lead to resource leaks in the Linux kernel on affected platforms, which may cause increased memory usage or system instability over time if the leaked resources accumulate. It may affect system reliability and performance on the SGI-IP27 platform.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch or update that fixes the platform-device leak in bridge_platform_create() in the Linux kernel, specifically ensuring that platform_device_put() is called to release failed 'pdev' devices and that platform_device_unregister() is used to release sgi_w1 resources when xtalk-bridge registration fails.