{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-50396", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-50396", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-09-18T13:33:14.450Z", "updatedAt": "2026-05-11T19:18:43.526Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "net: sched: fix memory leak in tcindex_set_parms", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix memory leak in tcindex_set_parms\n\nSyzkaller reports a memory leak as follows:\n====================================\nBUG: memory leak\nunreferenced object 0xffff88810c287f00 (size 256):\n comm \"syz-executor105\", pid 3600, jiffies 4294943292 (age 12.990s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046\n [] kmalloc include/linux/slab.h:576 [inline]\n [] kmalloc_array include/linux/slab.h:627 [inline]\n [] kcalloc include/linux/slab.h:659 [inline]\n [] tcf_exts_init include/net/pkt_cls.h:250 [inline]\n [] tcindex_set_parms+0xa7/0xbe0 net/sched/cls_tcindex.c:342\n [] tcindex_change+0xdf/0x120 net/sched/cls_tcindex.c:553\n [] tc_new_tfilter+0x4f2/0x1100 net/sched/cls_api.c:2147\n [] rtnetlink_rcv_msg+0x4dc/0x5d0 net/core/rtnetlink.c:6082\n [] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2540\n [] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345\n [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921\n [] sock_sendmsg_nosec net/socket.c:714 [inline]\n [] sock_sendmsg+0x56/0x80 net/socket.c:734\n [] ____sys_sendmsg+0x178/0x410 net/socket.c:2482\n [] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536\n [] __sys_sendmmsg+0x105/0x330 net/socket.c:2622\n [] __do_sys_sendmmsg net/socket.c:2651 [inline]\n [] __se_sys_sendmmsg net/socket.c:2648 [inline]\n [] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2648\n [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n [] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n====================================\n\nKernel uses tcindex_change() to change an existing\nfilter properties.\n\nYet the problem is that, during the process of changing,\nif `old_r` is retrieved from `p->perfect`, then\nkernel uses tcindex_alloc_perfect_hash() to newly\nallocate filter results, uses tcindex_filter_result_init()\nto clear the old filter result, without destroying\nits tcf_exts structure, which triggers the above memory leak.\n\nTo be more specific, there are only two source for the `old_r`,\naccording to the tcindex_lookup(). `old_r` is retrieved from\n`p->perfect`, or `old_r` is retrieved from `p->h`.\n\n * If `old_r` is retrieved from `p->perfect`, kernel uses\ntcindex_alloc_perfect_hash() to newly allocate the\nfilter results. Then `r` is assigned with `cp->perfect + handle`,\nwhich is newly allocated. So condition `old_r && old_r != r` is\ntrue in this situation, and kernel uses tcindex_filter_result_init()\nto clear the old filter result, without destroying\nits tcf_exts structure\n\n * If `old_r` is retrieved from `p->h`, then `p->perfect` is NULL\naccording to the tcindex_lookup(). Considering that `cp->h`\nis directly copied from `p->h` and `p->perfect` is NULL,\n`r` is assigned with `tcindex_lookup(cp, handle)`, whose value\nshould be the same as `old_r`, so condition `old_r && old_r != r`\nis false in this situation, kernel ignores using\ntcindex_filter_result_init() to clear the old filter result.\n\nSo only when `old_r` is retrieved from `p->perfect` does kernel use\ntcindex_filter_result_init() to clear the old filter result, which\ntriggers the above memory leak.\n\nConsidering that there already exists a tc_filter_wq workqueue\nto destroy the old tcindex_d\n---truncated---", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "53af9c793f644d5841d84d8e0ad83bd7ab47f3e0" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "01d0d2b8b4e3cf2110baba9371c0c3d04ad5c77b" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "55ac68b53f1cea1926ee2313afc5d66b91daad71" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "7a6fb69bbcb21e9ce13bdf18c008c268874f0480" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "b314f6c3512108d7a656c5caf07c82d1bbbdc0f1" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "18c3fa7a7fdbb4d21dafc8a7710ae2c1680930f6" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "6c55953e232ea668731091d111066521f3b7719b" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "7c183dc0af472dec33d2c0786a5e356baa8cad19" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "c4de6057e7c6654983acb63d939d26ac0d7bbf39" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "facc4405e8b7407e03216207b1d1d640127de0c8" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "3abebc503a5148072052c229c6b04b329a420ecd" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "399ab7fe0fa0d846881685fd4e57e9a8ef7559f7" }, { "version": "b9a24bb76bf611a5268ceffe04219e6ad264559b", "status": "affected", "versionType": "git", "lessThan": "372ae77cf11d11fb118cbe2d37def9dd5f826abd" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.9" }, { "version": "4.14.308", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.276", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.229", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.4.235", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.163", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.10.173", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.87", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "5.15.100", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.0.19", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.0.*" }, { "version": "6.1.5", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.1.18", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.2.5", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.2.*" }, { "version": "6.2", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }