CVE-2022-50007
published 2025-06-18CVE-2022-50007: In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error path in…
PriorityP417medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
11.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix refcount leak in __xfrm_policy_check()
The issue happens on an error path in __xfrm_policy_check(). When the
fetching process of the object `pols[1]` fails, the function simply
returns 0, forgetting to decrement the reference count of `pols[0]`,
which is incremented earlier by either xfrm_sk_policy_lookup() or
xfrm_policy_lookup(). This may result in memory leaks.
Fix it by decreasing the reference count of `pols[0]` in that path.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 18e6b6e2555c93f5ca09f2b85ef1fa025c8accea | 18e6b6e2555c93f5ca09f2b85ef1fa025c8accea |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 8f94b933103ee1bda119543369cc18a1be5536db | 8f94b933103ee1bda119543369cc18a1be5536db |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 0769491a8acd3e85ca4c3f65080eac2c824262df | 0769491a8acd3e85ca4c3f65080eac2c824262df |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 63da7a2bbf3f28094920e0b8a17d2571a9bd842d | 63da7a2bbf3f28094920e0b8a17d2571a9bd842d |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 1305d7d4f35ca6f214a2d23b075aa6a924cff3be | 1305d7d4f35ca6f214a2d23b075aa6a924cff3be |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 26ad2398fe4984f4f6f930bcb3bc9047fa77265b | 26ad2398fe4984f4f6f930bcb3bc9047fa77265b |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < d66c052879791313f90c0584420f196a038fb8b8 | d66c052879791313f90c0584420f196a038fb8b8 |
| linux | linux | >= 134b0fc544ba062498451611cb6f3e4454221b3d < 9c9cb23e00ddf45679b21b4dacc11d1ae7961ebe | 9c9cb23e00ddf45679b21b4dacc11d1ae7961ebe |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 2.6.20 < 4.9.327 | 4.9.327 |
| linux | linux_kernel | >= 4.10 < 4.14.292 | 4.14.292 |
| linux | linux_kernel | >= 4.15 < 4.19.257 | 4.19.257 |
| linux | linux_kernel | >= 4.20 < 5.4.212 | 5.4.212 |
| linux | linux_kernel | >= 5.11 < 5.15.64 | 5.15.64 |
| linux | linux_kernel | >= 5.16 < 5.19.6 | 5.19.6 |
| linux | linux_kernel | >= 5.5 < 5.10.140 | 5.10.140 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: xfrm: fix refcount leak in __xfrm_policy_check()
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50007 [MEDIUM] CWE-911 kernel: xfrm: fix refcount leak in __xfrm_policy_check()
kernel: xfrm: fix refcount leak in __xfrm_policy_check()
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix refcount leak in __xfrm_policy_check()
The issue happens on an error path in __xfrm_policy_check(). When the
fetching process of the object `pols[1]` fails, the function simply
returns 0, forgetting to decrement the reference count of `pols[0]`,
which is incremented earlier by either xfrm_sk_policy_lookup() or
xfrm_policy_lookup(). This may result in memory leaks.
Fix it by decreasing the reference count of `pols[0]` in that path.
A flaw was found in the XFRM subsystem in the Linux kernel. A missing decrement of the reference count when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service.
Debian
CVE-2022-50007: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm: fix r...
vendor_debian·2022·CVSS 5.5
CVE-2022-50007 [MEDIUM] CVE-2022-50007: linux - In the Linux kernel, the following vulnerability has been resolved: xfrm: fix r...
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error path in __xfrm_policy_check(). When the fetching process of the object `pols[1]` fails, the function simply returns 0, forgetting to decrement the reference count of `pols[0]`, which is incremented earlier by either xfrm_sk_policy_lookup() or xfrm_policy_lookup(). This may result in memory leaks. Fix it by decreasing the reference count of `pols[0]` in that path.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved (fixed in 5.10.140-1)
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
OSV
CVE-2022-50007: In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error pat
osv·2025-06-18·CVSS 5.5
CVE-2022-50007 [MEDIUM] CVE-2022-50007: In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error pat
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error path in __xfrm_policy_check(). When the fetching process of the object `pols[1]` fails, the function simply returns 0, forgetting to decrement the reference count of `pols[0]`, which is incremented earlier by either xfrm_sk_policy_lookup() or xfrm_policy_lookup(). This may result in memory leaks. Fix it by decreasing the reference count of `pols[0]` in that path.
GHSA
GHSA-g8hq-q89f-265v: In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix refcount leak in __xfrm_policy_check()
The issue happens on an error p
ghsa_unreviewed·2025-06-18
CVE-2022-50007 [MEDIUM] GHSA-g8hq-q89f-265v: In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix refcount leak in __xfrm_policy_check()
The issue happens on an error p
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix refcount leak in __xfrm_policy_check()
The issue happens on an error path in __xfrm_policy_check(). When the
fetching process of the object `pols[1]` fails, the function simply
returns 0, forgetting to decrement the reference count of `pols[0]`,
which is incremented earlier by either xfrm_sk_policy_lookup() or
xfrm_policy_lookup(). This may result in memory leaks.
Fix it by decreasing the reference count of `pols[0]` in that path.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0769491a8acd3e85ca4c3f65080eac2c824262dfhttps://git.kernel.org/stable/c/1305d7d4f35ca6f214a2d23b075aa6a924cff3behttps://git.kernel.org/stable/c/18e6b6e2555c93f5ca09f2b85ef1fa025c8acceahttps://git.kernel.org/stable/c/26ad2398fe4984f4f6f930bcb3bc9047fa77265bhttps://git.kernel.org/stable/c/63da7a2bbf3f28094920e0b8a17d2571a9bd842dhttps://git.kernel.org/stable/c/8f94b933103ee1bda119543369cc18a1be5536dbhttps://git.kernel.org/stable/c/9c9cb23e00ddf45679b21b4dacc11d1ae7961ebehttps://git.kernel.org/stable/c/d66c052879791313f90c0584420f196a038fb8b8
2025-06-18
Published