CVE-2022-50304
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-12-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.10 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a resource leak in the Linux kernel's mtd (memory technology device) core, specifically in the init_mtd() function. When init_mtdchar() fails during initialization, the mtd_bdi (backing device info) is not unregistered properly. This causes an error where the system cannot create duplicate filenames in sysfs, preventing the mtd module from being loaded again. The fix involves ensuring that bdi_unregister(mtd_bdi) is called to clean up resources after failure.
How can this vulnerability impact me? :
This vulnerability can cause the mtd module to fail to load again after an initialization failure due to resource leakage. This can lead to system instability or inability to properly manage memory technology devices, potentially affecting system functionality that relies on these devices.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing error messages related to duplicate sysfs entries for mtd devices, such as 'sysfs: cannot create duplicate filename \'/devices/virtual/bdi/mtd-0\'' and errors like 'kobject_add_internal failed for mtd-0 with -EEXIST'. Checking kernel logs (e.g., using 'dmesg' or 'journalctl -k') for these specific errors can help identify the issue. Commands to detect this include: 'dmesg | grep mtd', 'dmesg | grep sysfs', or 'journalctl -k | grep mtd'.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the fix is applied, which involves calling bdi_unregister(mtd_bdi) after the out_procfs label in init_mtd() to prevent resource leaks and allow the mtd module to be reloaded properly. Until the update is applied, avoid repeatedly loading and unloading the mtd module to prevent the resource leak and duplicate sysfs entries.