CVE-2022-50639
Estado: AplazadaSin puntuar—
In the Linux kernel, the following vulnerability has been resolved:
io-wq: Fix memory leak in worker creation
If the CPU mask allocation for a node fails, then the memory allocated for the 'io_wqe' struct of the current node doesn't get freed on the error handling path, since it has not yet been added to the 'wqes' array.
Detalles técnicos trazas, registros y código del informe original
This was spotted when fuzzing v6.1-rc1 with Syzkaller:
BUG: memory leak
unreferenced object 0xffff8880093d5000 (size 1024):
comm "syz-executor.2", pid 7701, jiffies 4295048595 (age 13.900s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000cb463369>] __kmem_cache_alloc_node+0x18e/0x720
[<00000000147a3f9c>] kmalloc_node_trace+0x2a/0x130
[<000000004e107011>] io_wq_create+0x7b9/0xdc0
[<00000000c38b2018>] io_uring_alloc_task_context+0x31e/0x59d
[<00000000867399da>] __io_uring_add_tctx_node.cold+0x19/0x1ba
[<000000007e0e7a79>] io_uring_setup.cold+0x1b80/0x1dce
[<00000000b545e9f6>] __x64_sys_io_uring_setup+0x5d/0x80
[<000000008a8a7508>] do_syscall_64+0x5d/0x90
[<000000004ac08bec>] entry_SYSCALL_64_after_hwframe+0x63/0xcdCVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-50639",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0e03496d1967abf1ebb151a24318c07d07f41f7f",
"lessThan": "b6e2c54be37d5eb4f6666e6aa59cd0581c7ffc3c",
"versionType": "git"
},
{
"status": "affected",
"version": "0e03496d1967abf1ebb151a24318c07d07f41f7f",
"lessThan": "ed981911a7c90a604f4a2bee908ab07e3b786aca",
"versionType": "git"
},
{
"status": "affected",
"version": "0e03496d1967abf1ebb151a24318c07d07f41f7f",
"lessThan": "996d3efeb091c503afd3ee6b5e20eabf446fd955",
"versionType": "git"
}
],
"programFiles": [
"io_uring/io-wq.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.0.4",
"versionType": "semver",
"lessThanOrEqual": "6.0.*"
},
{
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"io_uring/io-wq.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-12-09T01:16:46.280",
"references": [
{
"url": "https://git.kernel.org/stable/c/996d3efeb091c503afd3ee6b5e20eabf446fd955",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b6e2c54be37d5eb4f6666e6aa59cd0581c7ffc3c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ed981911a7c90a604f4a2bee908ab07e3b786aca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Deferred",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: Fix memory leak in worker creation\n\nIf the CPU mask allocation for a node fails, then the memory allocated for\nthe 'io_wqe' struct of the current node doesn't get freed on the error\nhandling path, since it has not yet been added to the 'wqes' array.\n\nThis was spotted when fuzzing v6.1-rc1 with Syzkaller:\nBUG: memory leak\nunreferenced object 0xffff8880093d5000 (size 1024):\n comm \"syz-executor.2\", pid 7701, jiffies 4295048595 (age 13.900s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [<00000000cb463369>] __kmem_cache_alloc_node+0x18e/0x720\n [<00000000147a3f9c>] kmalloc_node_trace+0x2a/0x130\n [<000000004e107011>] io_wq_create+0x7b9/0xdc0\n [<00000000c38b2018>] io_uring_alloc_task_context+0x31e/0x59d\n [<00000000867399da>] __io_uring_add_tctx_node.cold+0x19/0x1ba\n [<000000007e0e7a79>] io_uring_setup.cold+0x1b80/0x1dce\n [<00000000b545e9f6>] __x64_sys_io_uring_setup+0x5d/0x80\n [<000000008a8a7508>] do_syscall_64+0x5d/0x90\n [<000000004ac08bec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
}
],
"lastModified": "2026-06-17T05:23:54.870",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}