PT-2025-40131 · Linux · Linux Kernel

Published 2025-10-01 · Updated 2025-10-01 · CVE-2022-50446

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.15-rc1 and later

Description A memory leak exists in the Linux kernel related to page table entries (PTEs). Following commit d9820ff, memory allocated for PTEs was not being released during process termination, leading to a reduction in available memory with repeated allocations. This issue affects all ARC CPUs. The root cause is an incorrect address being passed to the pte free() function due to the pmd pgtable macro returning a direct virtual address instead of a pointer to the struct page. The fix involves modifying the pmd pgtable macro to return a pointer to struct page.

Recommendations Update to a newer kernel version that includes the fix for this memory leak.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-50446

Affected Products

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50446.json · Exploit
• https://git.kernel.org/stable/c/4fd9df10cb7a9289fbd22d669f9f98164d95a1ce · Patch
• https://osv.dev/vulnerability/CVE-2022-50446 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50446 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50446 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50446 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50446 · Security Note
• https://ubuntu.com/security/CVE-2022-50446 · Vendor Advisory
• https://git.kernel.org/stable/c/14009ada5712649589ab4ad0441b811780ea8773 · Patch
• https://git.kernel.org/stable/c/d83a69966e8b6ae9dd447f3ac704c0223bceb7f7 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50446 · Vendor Advisory
• https://git.kernel.org/linus/4fd9df10cb7a9289fbd22d669f9f98164d95a1ce · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1973391515394383962 · Twitter Post