CVE-2022-50751

published 2025-12-24

CVE-2022-50751: In the Linux kernel, the following vulnerability has been resolved: configfs: fix possible memory leak in configfs_create_dir() kmemleak reported memory leaks…

Priority P4 21 low 5.5

In the Linux kernel, the following vulnerability has been resolved:

configfs: fix possible memory leak in configfs_create_dir()

kmemleak reported memory leaks in configfs_create_dir():

unreferenced object 0xffff888009f6af00 (size 192):
comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s)
backtrace:
kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273)
new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163)
configfs_register_subsystem (fs/configfs/dir.c:1857)
basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic
do_one_initcall (init/main.c:1296)
do_init_module (kernel/module/main.c:2455)
...

unreferenced object 0xffff888003ba7180 (size 96):
comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s)
backtrace:
kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273)
configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194)
configfs_make_dirent (fs/configfs/dir.c:248)
configfs_create_dir (fs/configfs/dir.c:296)
configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852)
configfs_register_subsystem (fs/configfs/dir.c:1881)
basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic
do_one_initcall (init/main.c:1296)
do_init_module (kernel/module/main.c:2455)
...

This is because the refcount is not correct in configfs_make_dirent().
For normal stage, the refcount is changing as:

configfs_register_subsystem()
configfs_create_dir()
configfs_make_dirent()
configfs_new_dirent() # set s_count = 1
dentry->d_fsdata = configfs_get(sd); # s_count = 2
...
configfs_unregister_subsystem()
configfs_remove_dir()
remove_dir()
configfs_remove_dirent() # s_count = 1
dput() ...
*dentry_unlink_inode()*
configfs_d_iput() # s_count = 0, release

However, if we failed in configfs_create():

configfs_register_subsystem()
configfs_create_dir()
configfs_make_dirent() # s_count = 2
...
configfs_create() # fail
->out_remove:
configfs_remove_dirent(dentry)
configfs_put(sd) # s_count = 1
retu

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.4-1 (bookworm)	linux 6.1.4-1 (bookworm)
linux	linux	—	—
linux	linux	>= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 90c38f57a821499391526b15cc944c265bd24e48	90c38f57a821499391526b15cc944c265bd24e48
linux	linux	>= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 74ac7c9ee2d486c501e7864c903f5098fc477acd	74ac7c9ee2d486c501e7864c903f5098fc477acd
linux	linux	>= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 07f82dca112262b169bec0001378126439cab776	07f82dca112262b169bec0001378126439cab776
linux	linux	>= 7063fbf2261194f72ee75afca67b3b38b554b5fa < 8bc77754224a2c8581727ffe2e958119b4e27c8f	8bc77754224a2c8581727ffe2e958119b4e27c8f
linux	linux	>= 7063fbf2261194f72ee75afca67b3b38b554b5fa < c72eb6e6e49a71f7598740786568fafdd013a227	c72eb6e6e49a71f7598740786568fafdd013a227
linux	linux	>= 7063fbf2261194f72ee75afca67b3b38b554b5fa < c65234b283a65cfbfc94619655e820a5e55199eb	c65234b283a65cfbfc94619655e820a5e55199eb
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 0 < 6.1.4-1	6.1.4-1
linux	linux_kernel	>= 2.6.16 < 5.4.229	5.4.229
linux	linux_kernel	>= 5.11.0 < 5.15.86	5.15.86
linux	linux_kernel	>= 5.16.0 < 6.0.16	6.0.16
linux	linux_kernel	>= 5.5.0 < 5.10.163	5.10.163
linux	linux_kernel	>= 6.1.0 < 6.1.2	6.1.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-772