PT-2025-40142 · Linux · Linux Kernel

Published 2022-11-24 · Updated 2025-10-01 · CVE-2022-50457

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc3+ #54

Description The Linux kernel contains a flaw in the del mtd device() function related to reference counting. Specifically, the function calls of node put() on a potentially cleared device node pointer, leading to a reference count leak. This occurs because memset(&mtd->dev, 0) is called before of node put(), which can result in of node put(NULL) having no effect. The issue is fixed by caching the pointer of the device node. The error manifests as an unbalanced of node get()/of node put() resulting in a memory leak.

Recommendations Update to a version newer than 6.1.0-rc3+ #54 to address this issue.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2026-03834

CVE-2022-50457

Affected Products

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50457.json · Exploit
• https://git.kernel.org/stable/c/56570bdad5e31c5c538cd6efff5c4510256e1bb4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50457 · Security Note
• https://git.kernel.org/stable/c/616dc895d982026f41f500c88d1bfea004938cc8 · Patch
• https://git.kernel.org/stable/c/f6016557f1ef7735963bd8691592d2797bbf91d2 · Patch
• https://osv.dev/vulnerability/CVE-2022-50457 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50457 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03834 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50457 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-50457 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.2 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1973391504644382959 · Twitter Post