PT-2025-26152 · Linux+2 · Linux Kernel+2

Published 2025-06-18 · Updated 2025-08-18 · CVE-2022-50226

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A kernel memory leak issue has been identified in the Linux kernel's crypto subsystem, specifically in the ccp driver. The problem occurs when input passed to certain sev ioctl interfaces is less than or equal to SEV FW BLOB MAX SIZE but larger than the data returned by PSP firmware. This causes kmalloc to allocate memory based on the input size rather than the data size, potentially leading to the return of uninitialized slab memory. To prevent this issue, the ioctl interfaces in the ccp driver have been modified to use kzalloc and memset the data buffer to zero.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-05852

CVE-2022-50226

RHSA-2023:2458

RHSA-2023:2951

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:02322-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:02846-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02537-1

SUSE-SU-2025_02846-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 741

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50226.json · Exploit
• https://bdu.fstec.ru/vul/2026-05852 · Security Note
• https://git.kernel.org/stable/c/e11fb0a3a39bb42da35fa662c46ce7391f277436 · Patch
• https://git.kernel.org/stable/c/13dc15a3f5fd7f884e4bfa8c011a0ae868df12ae · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02846-1 · Vendor Advisory
• https://git.kernel.org/stable/c/f2a920daa780956b987c14b9f23de7c3c8915bf2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50226 · Vendor Advisory
• https://git.kernel.org/stable/c/caa395aa16e7c9193fd7fa6cde462dd8229d4953 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02537-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50226 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50226 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50226 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50226 · Vendor Advisory
• https://git.kernel.org/stable/c/4c5300f6f5e18b11c02a92f136e69b98fddba15e · Patch