CVE-2022-49627

ima: Fix potential memory leak in ima_init_crypto()

State: Published
Severity: 5.5 Medium
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ima: Fix potential memory leak in ima_init_crypto()

On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the ima_algo_array. Add the missing kfree() for ima_algo_array to avoid the potential memory leak.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	6d94809af6b0830c4dfcad661535a5939bcb8a7d to before c1d9702ceb4a091da6bee380627596d1fba09274Affected 6d94809af6b0830c4dfcad661535a5939bcb8a7d to before 601ae26aa2802a4c10c94d7388a99eabdbefab2bAffected 6d94809af6b0830c4dfcad661535a5939bcb8a7d to before 830de9667b3ada0a75a3f098dfc7159709fe397bAffected 6d94809af6b0830c4dfcad661535a5939bcb8a7d to before 067d2521874135267e681c19d42761c601d503d6Affected
LinuxLinux	5.8Affected before 5.8Not affected 5.10.132 through 5.10.Not affected 5.15.56 through 5.15.Not affected 5.18.13 through 5.18.*Not affected 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.