CVE-2022-50289
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-12-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 2.6.27 (inc) to 4.9.337 (exc) |
| linux | linux_kernel | From 4.10 (inc) to 4.14.303 (exc) |
| linux | linux_kernel | From 4.15 (inc) to 4.19.270 (exc) |
| linux | linux_kernel | From 4.20 (inc) to 5.4.229 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.163 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.86 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
| linux | linux_kernel | 2.6.26 |
| linux | linux_kernel | 2.6.26 |
| linux | linux_kernel | 2.6.26 |
| linux | linux_kernel | 2.6.26 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's ocfs2 module. Specifically, the ocfs2_stack_glue_init() function does not free the ocfs2_table_header if ocfs2_sysfs_init() fails, causing a memory leak that is detected by kmemleak.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a memory leak in the Linux kernel's ocfs2_stack_glue_init() function when ocfs2_sysfs_init() fails. Detection can be done by monitoring kernel memory leak reports, specifically looking for kmemleak reports indicating unreferenced objects related to ocfs2. You can enable and check kmemleak reports using the following commands: 1. Enable kmemleak (if not already enabled): echo scan > /sys/kernel/debug/kmemleak 2. Check kmemleak reports: cat /sys/kernel/debug/kmemleak Look for entries mentioning ocfs2 or related memory leaks. Additionally, reviewing kernel logs (dmesg) for memory leak warnings or modprobe related errors may help detect this issue.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your Linux kernel to a version where the ocfs2 memory leak in ocfs2_stack_glue_init() has been fixed. This patch ensures that ocfs2_table_header is properly freed if ocfs2_sysfs_init() fails, preventing the memory leak. Until the update is applied, monitor kmemleak reports and avoid triggering ocfs2_sysfs_init() failures if possible.
How can this vulnerability impact me? :
The impact of this vulnerability is a memory leak in the Linux kernel, which can lead to increased memory usage and potentially degrade system performance or stability over time if the leak accumulates.