CVE-2022-50569

Linux Kernel - Use-After-Free in IPComp Scratch Buffer Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below: static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about this allocation failure. Therefore holding the old obsolete address. ... } So when we free, static void ipcomp_free_scratches(void) { ... scratches = ipcomp_scratches; Assigning obsolete address from ipcomp_scratches if (!scratches) return; for_each_possible_cpu(i) vfree(*per_cpu_ptr(scratches, i)); Trying to free non existent page, causing warning: trying to vfree existent vm area. ... } Fix this breakage by updating ipcomp_scrtches with NULL when scratches is freed

Scores

EPSS 0.0023
EPSS Percentile 14.2%

Details

Status published
Products (28)
linux/Kernel 2.6.12 - 4.9.331linux
linux/Kernel 4.10.0 - 4.14.296linux
linux/Kernel 4.15.0 - 4.19.262linux
linux/Kernel 4.20.0 - 5.4.220linux
linux/Kernel 5.11.0 - 5.15.75linux
linux/Kernel 5.16.0 - 5.19.17linux
linux/Kernel 5.20.0 - 6.0.3linux
linux/Kernel 5.5.0 - 5.10.150linux
Linux/Linux < 2.6.12
Linux/Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 - 03155680191ef0f004b1d6a5714c5b8cd271ab61
... and 18 more
Published Oct 22, 2025
Tracked Since Feb 18, 2026