Junglewise Threat Intelligence

CVE-2022-50569: Linux kernel use-after-free in IPComp memory management

CVE-2022-50569 · Severity: high · CVSS 7.8 · Published 2025-10-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's IPComp (IP Payload Compression Protocol) component fails to properly clean up memory references when buffer allocation fails, leaving stale pointers that cause invalid memory access when cleanup functions run. This can lead to kernel crashes and system instability when the affected code path is triggered.

Technical details

The vulnerability exists in the IPComp implementation where ipcomp_scratches holds a pointer to pre-allocated per-CPU buffers. When ipcomp_alloc_scratches() fails to allocate memory, it returns NULL but fails to update the global ipcomp_scratches pointer, which retains a stale reference to a previously freed memory area. Subsequently, when ipcomp_free_scratches() is called, it attempts to free the non-existent memory region via vfree(), causing kernel warnings and potential system instability. The fix is a one-line change ensuring ipcomp_scratches is set to NULL after proper cleanup. No special privileges are required to trigger this via memory pressure or craft conditions affecting buffer allocation.

Affected products

  • Linux Linux Kernel Multiple versions from 2.6.11 through 6.x (prior to fix commit 8a04d2fc700f717104bfb95b0f6694e448a4537f)

Timeline

  • 2022-10-26: disclosed
  • 2022-10-26: patched

References

Related threats