CVE-2022-50376

orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()

State: Published
Severity: 5.5 Medium
Published: Sep 18, 2025
Updated: Aug 15, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()

When insert and remove the orangefs module, there are memory leaked as below:

unreferenced object 0xffff88816b0cc000 (size 2048): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): 6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00 none............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005b405fee>] orangefs_debugfs_init.cold+0xaf/0x17f [<00000000e5a0085b>] 0xffffffffa02780f9 [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Use the golbal variable as the buffer rather than dynamic allocate to slove the problem.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before bdc2d33fa2324b1f5ab5b701cda45ee0b2384409Affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before a076490b0211990ec6764328c22cb744dd782bd9Affected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before c8853267289c55b1acbe4dc3641374887584834dAffected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before 786e5296f9e3b045d5ff9098514ce7b8ba1d890dAffected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before 0cd303aad220fafa595e0ed593e99aa51b90412bAffected 274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before 31720a2b109b3080eb77e97b8f6f50a27b4ae599Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.86 through 5.15.Not affected 6.0.16 through 6.0.Not affected 6.1.2 through 6.1.*Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before bdc2d33fa2324b1f5ab5b701cda45ee0b2384409Affected
274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before a076490b0211990ec6764328c22cb744dd782bd9Affected
274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before c8853267289c55b1acbe4dc3641374887584834dAffected
274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before 786e5296f9e3b045d5ff9098514ce7b8ba1d890dAffected
274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before 0cd303aad220fafa595e0ed593e99aa51b90412bAffected
274dcf55bd4ab12af1cc1d3b77416285bef8ebf4 to before 31720a2b109b3080eb77e97b8f6f50a27b4ae599Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.86 through 5.15.*Not affected
6.0.16 through 6.0.*Not affected
6.1.2 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.