CVE-2022-50376
BaseFortify
Publication date: 2025-09-18
Last updated on: 2025-12-11
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.6 (inc) to 5.4.229 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.163 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.86 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's orangefs module. When the orangefs module is inserted and removed, memory that was dynamically allocated is not properly freed, causing a leak. The issue occurs because the code uses dynamic allocation for a buffer instead of a global variable. This has been fixed by changing the code to use a global variable as the buffer, preventing the memory leak.
How can this vulnerability impact me? :
The memory leak caused by this vulnerability can lead to increased memory usage over time when repeatedly inserting and removing the orangefs module. This could degrade system performance or stability, especially on systems where the module is frequently loaded and unloaded.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by modifying the orangefs kernel module to use a global variable as the buffer instead of dynamically allocating memory, which prevents the memory leak when inserting and removing the orangefs module. To mitigate this vulnerability, update your Linux kernel to a version that includes this fix for orangefs. Avoid repeatedly inserting and removing the orangefs module until the fix is applied.