Read the docs
TI-2022-25925 Aliases CVE-2022-50446GHSA-wpvw-hhw9-p3qj

ARC: mm: fix leakage of memory allocated for PTE

Priority LOW 24CWE-401Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-401.

Summary

In the Linux kernel, the following vulnerability has been resolved: ARC: mm: fix leakage of memory allocated for PTE Since commit d9820ff ("ARC: mm: switch pgtable_t back to struct page *") a memory leakage problem occurs. Memory allocated for page table entries not released during process termination. This issue can be reproduced by a small program that allocates a large amount of memory. After several runs, you'll see that the amount of free memory has reduced and will continue to reduce after each run. All ARC CPUs are effected by this issue. The issue was introduced since the kernel stable release v5.15-rc1. As described in commit d9820ff after switch pgtable_t back to struct page *, a pointer to "struct page" and appropriate functions are used to allocate and free a memory page for PTEs, but the pmd_pgtable macro hasn't changed and returns the direct virtual address from the PMD (PGD) entry. Than this address used as a parameter in the __pte_free() and as a result this function couldn't release memory page allocated for PTEs. Fix this issue by changing the pmd_pgtable macro and returning pointer to struct page.

Why it matters now

EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 5.15.77, 6.0.7, 6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.15 and later5.15.77, 6.0.7, 6.1Patch availableCNA
  • Linux VendorLinux Affected 5.15 and later Fixed in 5.15.77, 6.0.7, 6.1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.15 to before 5.15.77; 5.16 to before 6.0.7VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*6.1 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*6.1 rc2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.15 to before 5.15.77; 5.16 to before 6.0.7 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* Versions 6.1 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* Versions 6.1 rc2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.15.77, 6.0.7, 6.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50446
  2. 2026-10-03 Alias added: GHSA-wpvw-hhw9-p3qj

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources