CVE-2022-50743
published 2025-12-24CVE-2022-50743: In the Linux kernel, the following vulnerability has been resolved: erofs: Fix pcluster memleak when its block address is zero syzkaller reported a memleak…
PriorityP420low5.5
EPSS
0.21%
10.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a memleak:
https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
unreferenced object 0xffff88811009c7f8 (size 136):
...
backtrace:
[] z_erofs_do_read_page+0x99b/0x1740
[] z_erofs_readahead+0x24e/0x580
[] read_pages+0x86/0x3d0
...
syzkaller constructed a case: in z_erofs_register_pcluster(),
ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be
zero although pcl is not a inline pcluster.
Then following path adds refcount for grp, but the refcount won't be put
because pcl is inline.
z_erofs_readahead()
z_erofs_do_read_page() # for another page
z_erofs_collector_begin()
erofs_find_workgroup()
erofs_workgroup_get()
Since it's illegal for the block address of a non-inlined pcluster to
be zero, add check here to avoid registering the pcluster which would
be leaked.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= cecf864d3d76d50e3d9c58145e286a0b8c284e92 < ac54c1f7b288d83b6ba1e320efff24ecc21309cd | ac54c1f7b288d83b6ba1e320efff24ecc21309cd |
| linux | linux | >= cecf864d3d76d50e3d9c58145e286a0b8c284e92 < 618e712b99c78d1004b70a1a9ab0a4830d0b2673 | 618e712b99c78d1004b70a1a9ab0a4830d0b2673 |
| linux | linux | >= cecf864d3d76d50e3d9c58145e286a0b8c284e92 < c42c0ffe81176940bd5dead474216b7198d77675 | c42c0ffe81176940bd5dead474216b7198d77675 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 5.17.0 < 6.0.16 | 6.0.16 |
| linux | linux_kernel | >= 6.1.0 < 6.1.2 | 6.1.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.0.15/6.1.1 erofs z_erofs_register_pcluster reference count (Nessus ID 279847 / WID-SEC-2025-2929)
vuldb·2026-04-21
CVE-2022-50743 [CRITICAL] Linux Kernel up to 6.0.15/6.1.1 erofs z_erofs_register_pcluster reference count (Nessus ID 279847 / WID-SEC-2025-2929)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.0.15/6.1.1. This affects the function z_erofs_register_pcluster of the component erofs. Executing a manipulation can lead to improper update of reference count.
This vulnerability appears as CVE-2022-50743. The attacker needs to be present on the local network. There is no available exploit.
It is advisable to upgrade the affected component.
OSV
CVE-2022-50743: In the Linux kernel, the following vulnerability has been resolved: erofs: Fix pcluster memleak when its block address is zero syzkaller reported a me
osv·2025-12-24
CVE-2022-50743 CVE-2022-50743: In the Linux kernel, the following vulnerability has been resolved: erofs: Fix pcluster memleak when its block address is zero syzkaller reported a me
In the Linux kernel, the following vulnerability has been resolved: erofs: Fix pcluster memleak when its block address is zero syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [] z_erofs_do_read_page+0x99b/0x1740 [] z_erofs_readahead+0x24e/0x580 [] read_pages+0x86/0x3d0 ... syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be zero although pcl is not a inline pcluster. Then following path adds refcount for grp, but the refcount won't be put because pcl is inline. z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup
OSV
erofs: Fix pcluster memleak when its block address is zero
osv·2025-12-24
CVE-2022-50743 erofs: Fix pcluster memleak when its block address is zero
erofs: Fix pcluster memleak when its block address is zero
In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a memleak:
https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
unreferenced object 0xffff88811009c7f8 (size 136):
...
backtrace:
[] z_erofs_do_read_page+0x99b/0x1740
[] z_erofs_readahead+0x24e/0x580
[] read_pages+0x86/0x3d0
...
syzkaller constructed a case: in z_erofs_register_pcluster(),
ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be
zero although pcl is not a inline pcluster.
Then following path adds refcount for grp, but the refcount won't be put
because pcl is inline.
z_erofs_readahead()
z_erofs_do_read_page() # for another pag
GHSA
GHSA-x7fv-mvjx-m6c8: In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a
ghsa_unreviewed·2025-12-24
CVE-2022-50743 GHSA-x7fv-mvjx-m6c8: In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a
In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a memleak:
https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
unreferenced object 0xffff88811009c7f8 (size 136):
...
backtrace:
[] z_erofs_do_read_page+0x99b/0x1740
[] z_erofs_readahead+0x24e/0x580
[] read_pages+0x86/0x3d0
...
syzkaller constructed a case: in z_erofs_register_pcluster(),
ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be
zero although pcl is not a inline pcluster.
Then following path adds refcount for grp, but the refcount won't be put
because pcl is inline.
z_erofs_readahead()
z_erofs_do_read_page() # for another page
z_erofs_collector_begin()
erofs_find_workgroup()
erofs_wor
Red Hat
kernel: Linux kernel: Denial of Service in erofs due to memory leak
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2022-50743 [LOW] CWE-772 kernel: Linux kernel: Denial of Service in erofs due to memory leak
kernel: Linux kernel: Denial of Service in erofs due to memory leak
In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a memleak:
https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
unreferenced object 0xffff88811009c7f8 (size 136):
...
backtrace:
[] z_erofs_do_read_page+0x99b/0x1740
[] z_erofs_readahead+0x24e/0x580
[] read_pages+0x86/0x3d0
...
syzkaller constructed a case: in z_erofs_register_pcluster(),
ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be
zero although pcl is not a inline pcluster.
Then following path adds refcount for grp, but the refcount won't be put
because pcl is inline.
z_erofs_readahead()
z_erofs_do_read_page() # for another
Debian
CVE-2022-50743: linux - In the Linux kernel, the following vulnerability has been resolved: erofs: Fix ...
vendor_debian·2022
CVE-2022-50743 CVE-2022-50743: linux - In the Linux kernel, the following vulnerability has been resolved: erofs: Fix ...
In the Linux kernel, the following vulnerability has been resolved: erofs: Fix pcluster memleak when its block address is zero syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [] z_erofs_do_read_page+0x99b/0x1740 [] z_erofs_readahead+0x24e/0x580 [] read_pages+0x86/0x3d0 ... syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be zero although pcl is not a inline pcluster. Then following path adds refcount for grp, but the refcount won't be put because pcl is inline. z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup
No detection rules found.
No public exploits indexed.
2025-12-24
Published