CVE-2022-50743

erofs: Fix pcluster memleak when its block address is zero

published December 24, 2025

CVSS
—
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

erofs: Fix pcluster memleak when its block address is zero

syzkaller reported a memleak:

https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed

unreferenced object 0xffff88811009c7f8 (size 136):

...

backtrace:

[<ffffffff821db19b>] z_erofs_do_read_page+0x99b/0x1740

[<ffffffff821dee9e>] z_erofs_readahead+0x24e/0x580

[<ffffffff814bc0d6>] read_pages+0x86/0x3d0

...

syzkaller constructed a case: in z_erofs_register_pcluster(),

ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be

zero although pcl is not a inline pcluster.

Then following path adds refcount for grp, but the refcount won't be put

because pcl is inline.

z_erofs_readahead()

z_erofs_do_read_page() # for another page

z_erofs_collector_begin()

erofs_find_workgroup()

erofs_workgroup_get()

Since it's illegal for the block address of a non-inlined pcluster to

be zero, add check here to avoid registering the pcluster which would

be leaked.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00235 · 13.7th percentile
Published
2025-12-24T13:05Z
EPSS history
Timeline
  • 24 DEC 13:05Z
    erofs: Fix pcluster memleak when its block address is zero
    cvelistv5