CVE-2022-50376CWE-401

CVE-2022-50376

Medium · published September 18, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
4.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()

When insert and remove the orangefs module, there are memory leaked

as below:

unreferenced object 0xffff88816b0cc000 (size 2048):

comm "insmod", pid 783, jiffies 4294813439 (age 65.512s)

hex dump (first 32 bytes):

6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00 none............

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace:

[<0000000031ab7788>] kmalloc_trace+0x27/0xa0

[<000000005b405fee>] orangefs_debugfs_init.cold+0xaf/0x17f

[<00000000e5a0085b>] 0xffffffffa02780f9

[<000000004232d9f7>] do_one_initcall+0x87/0x2a0

[<0000000054f22384>] do_init_module+0xdf/0x320

[<000000003263bdea>] load_module+0x2f98/0x3330

[<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0

[<00000000250ae02b>] do_syscall_64+0x35/0x80

[<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Use the golbal variable as the buffer rather than dynamic allocate to

slove the problem.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00161 · 4.9th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-09-18T18:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 4.6, < 5.4.2295.4.229
linux/linux_kernel≥ 5.5, < 5.10.1635.10.163
linux/linux_kernel≥ 5.11, < 5.15.865.15.86
linux/linux_kernel≥ 5.16, < 6.0.166.0.16
linux/linux_kernel≥ 6.1, < 6.1.26.1.2
References (6)
EPSS history
Timeline
  • 18 SEP 13:32Z
    orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
    cvelistv5