PT-2025-38012 · Linux+1 · Linux Kernel+1

Published 2025-09-16 · Updated 2025-09-26 · CVE-2022-50343

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the rapidio subsystem where a name leak can occur when the rio add device() function fails. Specifically, if rio add device() returns an error, the name allocated by dev set name() is not properly freed. This issue is addressed by using put device() to release the reference in the error path, allowing the name to be freed during kobject cleanup and the 'rdev' to be freed in rio release dev(). This patchset resolves three name leaks in error handling, with this patch focusing on the leaks occurring during rio add device() failures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-50343

OESA-2025-2348

Affected Products

Astra Linux

Linux Kernel

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50343.json · Exploit
• https://git.kernel.org/stable/c/f9574cd48679926e2a569e1957a5a1bcc8a719ac · Patch
• https://git.kernel.org/stable/c/88fa351b20ca300693a206ccd3c4b0e0647944d8 · Patch
• https://osv.dev/vulnerability/OESA-2025-2348 · Vendor Advisory
• https://git.kernel.org/stable/c/3b4676f274a6b5d001176f15d0542100bbf4b59a · Patch
• https://git.kernel.org/stable/c/85fbf58b15c09d3a6a03098c1e42ebfe9002f39d · Patch
• https://git.kernel.org/stable/c/80fad2e53eaed2b3a2ff596575f65669e13ceda5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50343 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50343 · Vendor Advisory
• https://git.kernel.org/stable/c/c482cb0deb57924335103fe592c379a076d867f8 · Patch
• https://ubuntu.com/security/CVE-2022-50343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53149 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-50343 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50343 · Security Note
• https://git.kernel.org/stable/c/440afd7fd9b164fdde6fc9da8c47d3d7f20dcce8 · Patch