CVE-2022-49256

watch_queue: Actually free the watch

MEDIUM
5.5
CVSS Score
Published: February 26, 2025 at 01:56 AM UTC
Updated: June 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: watch_queue: Actually free the watch free_watch() does everything barring actually freeing the watch object. Fix this by adding the missing kfree. kmemleak produces a report something like the following. Note that as an address can be seen in the first word, the watch would appear to have gone through call_rcu(). BUG: memory leak unreferenced object 0xffff88810ce4a200 (size 96): comm "syz-executor352", pid 3605, jiffies 4294947473 (age 13.720s) hex dump (first 32 bytes): e0 82 48 0d 81 88 ff ff 00 00 00 00 00 00 00 00 ..H............. 80 a2 e4 0c 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8214e6cc>] kmalloc include/linux/slab.h:581 [inline] [<ffffffff8214e6cc>] kzalloc include/linux/slab.h:714 [inline] [<ffffffff8214e6cc>] keyctl_watch_key+0xec/0x2e0 security/keys/keyctl.c:1800 [<ffffffff8214ec84>] __do_sys_keyctl+0x3c4/0x490 security/keys/keyctl.c:2016 [<ffffffff84493a25>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84493a25>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.11 ≤ v < 5.15.335.16 ≤ v < 5.16.195.17 ≤ v < 5.17.25.8 ≤ v < 5.10.1105.8 ≤ v < 5.15.335.8 ≤ v < 5.16.195.8 ≤ v < 5.17.25.8 ≤ v < 5.185.8c73be61cede5882f9605a852414db559c0ebedfd
Vendor states this is fixed in 31824613a42aacdcbeb325bf07a1c8247a11ebe2 (fixed)
Vendor states this is fixed in 3d8dcf278b1ee1eff1e90be848fa2237db4c07a7 (fixed)
Vendor states this is fixed in 7e8c9b0df07a77f0d072603b8ced2677e30e1893 (fixed)
Vendor states this is fixed in 9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b (fixed)
Vendor states this is fixed in f69aecb49968e14196366bbe896eab0a904229f5 (fixed)
Vendor states this is fixed in 5.10.110 (unaffected)
Vendor states this is fixed in 5.15.33 (unaffected)
Vendor states this is fixed in 5.16.19 (unaffected)
Vendor states this is fixed in 5.17.2 (unaffected)
Vendor states this is fixed in 5.18 (unaffected)
Vendor states this is fixed in 5.8 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/31824613a42aacdcbeb325bf07a1c8247a11ebe2
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3d8dcf278b1ee1eff1e90be848fa2237db4c07a7
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7e8c9b0df07a77f0d072603b8ced2677e30e1893
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f69aecb49968e14196366bbe896eab0a904229f5

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card