PT-2025-18518 · Linux+3 · Linux Kernel+3

Published 2025-05-01 · Updated 2026-03-14 · CVE-2022-49801

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the tracing read pipe() function. The kmemleak tool reports an unreferenced object, indicating a memory leakage problem. The issue occurs because the iter->fmt variable is allocated in the tracing read pipe() function but not freed, leading to a memory leak. The backtrace provided shows the sequence of function calls that lead to this issue.

Recommendations To resolve this issue, add a free operation in the tracing release pipe() function to release the allocated memory. This will prevent the memory leak and fix the vulnerability.

Note: Since the affected versions are not specified, it is recommended to apply this fix to all versions of the Linux kernel that are currently in use.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-05809

CVE-2022-49801

SUSE-SU-2025:01918-1

SUSE-SU-2025:01966-1

SUSE-SU-2025:02173-1

SUSE-SU-2025:02262-1

SUSE-SU-2025:2173-1

SUSE-SU-2025_02173-1

SUSE-SU-2025_02262-1

Affected Products

Astra Linux

Debian

Linux Kernel

Suse

References · 447

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49801.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49801 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49801 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49801 · Vendor Advisory
• https://git.kernel.org/stable/c/649e72070cbbb8600eb823833e4748f5a0815116 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49801 · Vendor Advisory
• https://git.kernel.org/stable/c/a7d3f8f33c113478737bc61bb32ec5f9a987da7d · Patch
• https://ubuntu.com/security/CVE-2022-49801 · Vendor Advisory
• https://git.kernel.org/stable/c/2c21ee020ce43d744ecd7f3e9bddfcaafef270ce · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02173-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05809 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01966-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49801 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49801 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49801 · Vendor Advisory