{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-50661", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-50661", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-12-09T01:29:09.498Z", "updatedAt": "2026-05-11T19:23:11.092Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "seccomp: Move copy_seccomp() to no failure path.", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nseccomp: Move copy_seccomp() to no failure path.\n\nOur syzbot instance reported memory leaks in do_seccomp() [0], similar\nto the report [1]. It shows that we miss freeing struct seccomp_filter\nand some objects included in it.\n\nWe can reproduce the issue with the program below [2] which calls one\nseccomp() and two clone() syscalls.\n\nThe first clone()d child exits earlier than its parent and sends a\nsignal to kill it during the second clone(), more precisely before the\nfatal_signal_pending() test in copy_process(). When the parent receives\nthe signal, it has to destroy the embryonic process and return -EINTR to\nuser space. In the failure path, we have to call seccomp_filter_release()\nto decrement the filter's refcount.\n\nInitially, we called it in free_task() called from the failure path, but\nthe commit 3a15fb6ed92c (\"seccomp: release filter after task is fully\ndead\") moved it to release_task() to notify user space as early as possible\nthat the filter is no longer used.\n\nTo keep the change and current seccomp refcount semantics, let's move\ncopy_seccomp() just after the signal check and add a WARN_ON_ONCE() in\nfree_task() for future debugging.\n\n[0]:\nunreferenced object 0xffff8880063add00 (size 256):\n comm \"repro_seccomp\", pid 230, jiffies 4294687090 (age 9.914s)\n hex dump (first 32 bytes):\n 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................\n ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................\n backtrace:\n do_seccomp (./include/linux/slab.h:600 ./include/linux/slab.h:733 kernel/seccomp.c:666 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\nunreferenced object 0xffffc90000035000 (size 4096):\n comm \"repro_seccomp\", pid 230, jiffies 4294687090 (age 9.915s)\n hex dump (first 32 bytes):\n 01 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n __vmalloc_node_range (mm/vmalloc.c:3226)\n __vmalloc_node (mm/vmalloc.c:3261 (discriminator 4))\n bpf_prog_alloc_no_stats (kernel/bpf/core.c:91)\n bpf_prog_alloc (kernel/bpf/core.c:129)\n bpf_prog_create_from_user (net/core/filter.c:1414)\n do_seccomp (kernel/seccomp.c:671 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\nunreferenced object 0xffff888003fa1000 (size 1024):\n comm \"repro_seccomp\", pid 230, jiffies 4294687090 (age 9.915s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n bpf_prog_alloc_no_stats (./include/linux/slab.h:600 ./include/linux/slab.h:733 kernel/bpf/core.c:95)\n bpf_prog_alloc (kernel/bpf/core.c:129)\n bpf_prog_create_from_user (net/core/filter.c:1414)\n do_seccomp (kernel/seccomp.c:671 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\nunreferenced object 0xffff888006360240 (size 16):\n comm \"repro_seccomp\", pid 230, jiffies 4294687090 (age 9.915s)\n hex dump (first 16 bytes):\n 01 00 37 00 76 65 72 6c e0 83 01 06 80 88 ff ff ..7.verl........\n backtrace:\n bpf_prog_store_orig_filter (net/core/filter.c:1137)\n bpf_prog_create_from_user (net/core/filter.c:1428)\n do_seccomp (kernel/seccomp.c:671 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991)\n do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)\nunreferenced object 0xffff888\n---truncated---", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "3a15fb6ed92cb32b0a83f406aa4a96f28c9adbc3", "status": "affected", "versionType": "git", "lessThan": "d4a895e924b486f2a38463114509e1088ef4d7f5" }, { "version": "3a15fb6ed92cb32b0a83f406aa4a96f28c9adbc3", "status": "affected", "versionType": "git", "lessThan": "a31a647a3d1073a642c5bbe3457731fb353cb980" }, { "version": "3a15fb6ed92cb32b0a83f406aa4a96f28c9adbc3", "status": "affected", "versionType": "git", "lessThan": "29a69fa075d0577eff1137426669de21187ec182" }, { "version": "3a15fb6ed92cb32b0a83f406aa4a96f28c9adbc3", "status": "affected", "versionType": "git", "lessThan": "5b81f0c6c60e35bf8153230ddfb03ebb14e17986" }, { "version": "3a15fb6ed92cb32b0a83f406aa4a96f28c9adbc3", "status": "affected", "versionType": "git", "lessThan": "a1140cb215fa13dcec06d12ba0c3ee105633b7c4" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "5.9", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "5.9" }, { "version": "5.10.180", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.86", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.0.16", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.0.*" }, { "version": "6.1.2", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.2", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }