PT-2025-43079 · Linux+2 · Linux Kernel+2

Published 2022-09-01 · Updated 2025-12-23 · CVE-2022-50569

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the xfrm subsystem related to memory management. Specifically, if ipcomp alloc scratches() fails to allocate memory, the ipcomp scratches variable retains an obsolete address. Subsequently, when ipcomp free scratches() attempts to free the per-CPU scratches, it may attempt to free a non-existent virtual memory area, resulting in a warning message. This occurs because ipcomp scratches is not updated to NULL upon allocation failure. The issue is addressed by updating ipcomp scratches with NULL when the scratches are freed. The vulnerable functions involved are ipcomp alloc scratches() and ipcomp free scratches(). The variable ipcomp scratches holds the obsolete address. The function vfree() attempts to free the non-existent page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Allocation of Resources Without Limits

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-404

CWE-400

Related Identifiers

ALSA-2025_16880

BDU:2026-01293

CESA-2023_2951

CVE-2022-50569

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:4515-1

Affected Products

Centos

Linux Kernel

Red Hat

References · 97

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50569.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-50569 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01293 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50569 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-50569 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50569 · Security Note
• https://ubuntu.com/security/CVE-2022-50569 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50569 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50569 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4515-1 · Vendor Advisory
• https://git.kernel.org/stable/c/03155680191ef0f004b1d6a5714c5b8cd271ab61 · Note
• https://bugzilla.suse.com/1252862 · Note
• https://suse.com/security/cve/CVE-2025-40030 · Note
• https://git.kernel.org/stable/c/a39f456d62810c0efb43cead22f98d95b53e4b1a · Note
• https://access.redhat.com/security/cve/cve-2022-50569 · Note