CVE-2022-50389

tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak

State: Published
Severity: 5.5 Medium
Published: Sep 18, 2025
Updated: May 11, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak

In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so the TPM2 table is not used after the init, should be freed, call acpi_put_table() to fix the memory leak.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 08fd965521d0e172d540cf945517810895fcb199Affected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 1af2232b13837ce0f3a082b9f43735b09aafc367Affected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 927860dfa161ae8392a264197257dbdc52b26b0fAffected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 0bd9b4be721c776f77adcaf34105dfca3007ddb9Affected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 986cd9a9b95423e35a2cbb8e9105aec0e0d7f337Affected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 2fcd3dc8b97a14f1672729c86b7041a1a89b052aAffected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before b0785edaf649e5f04dc7f75533e810f4c00e4106Affected 30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 37e90c374dd11cf4919c51e847c6d6ced0abc555Affected
LinuxLinux	4.0Affected before 4.0Not affected 4.14.303 through 4.14.Not affected 4.19.270 through 4.19.Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.87 through 5.15.Not affected 6.0.17 through 6.0.Not affected 6.1.3 through 6.1.*Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 08fd965521d0e172d540cf945517810895fcb199Affected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 1af2232b13837ce0f3a082b9f43735b09aafc367Affected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 927860dfa161ae8392a264197257dbdc52b26b0fAffected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 0bd9b4be721c776f77adcaf34105dfca3007ddb9Affected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 986cd9a9b95423e35a2cbb8e9105aec0e0d7f337Affected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 2fcd3dc8b97a14f1672729c86b7041a1a89b052aAffected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before b0785edaf649e5f04dc7f75533e810f4c00e4106Affected
30fc8d138e9123f374a3c3867e7c7c5cd4004941 to before 37e90c374dd11cf4919c51e847c6d6ced0abc555Affected

LinuxLinux

4.0Affected
before 4.0Not affected
4.14.303 through 4.14.*Not affected
4.19.270 through 4.19.*Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.87 through 5.15.*Not affected
6.0.17 through 6.0.*Not affected
6.1.3 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.