CVE-2022-50873

vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove

published December 30, 2025

CVSS
—
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove

In vp_vdpa_remove(), the code kfree(&vp_vdpa_mgtdev->mgtdev.id_table) uses

a reference of pointer as the argument of kfree, which is the wrong pointer

and then may hit crash like this:

Unable to handle kernel paging request at virtual address 00ffff003363e30c

Internal error: Oops: 96000004 [#1] SMP

Call trace:

rb_next+0x20/0x5c

ext4_readdir+0x494/0x5c4 [ext4]

iterate_dir+0x168/0x1b4

__se_sys_getdents64+0x68/0x170

__arm64_sys_getdents64+0x24/0x30

el0_svc_common.constprop.0+0x7c/0x1bc

do_el0_svc+0x2c/0x94

el0_svc+0x20/0x30

el0_sync_handler+0xb0/0xb4

el0_sync+0x160/0x180

Code: 54000220 f9400441 b4000161 aa0103e0 (f9400821)

SMP: stopping secondary CPUs

Starting crashdump kernel...

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00197 · 8.9th percentile
Published
2025-12-30T12:15Z
EPSS history
Timeline
  • 30 DEC 12:15Z
    vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove
    cvelistv5