7.8

CVE-2022-50569: linux

CVSS: 7.8v3.1HighDeferred
AliasesUBUNTU-CVE-2022-50569DEBIAN-CVE-2022-50569
Published 22-10-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2022-50569 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.17%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1
RHSA-2023:2458RHSA-2023:2951SUSE-SU-2025:4515-1

Timeline

  1. 22-10-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below: static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about this allocation failure. Therefore holding the old obsolete address. ... } So when we free, static void ipcomp_free_scratches(void) { ... scratches = ipcomp_scratches; Assigning obsolete address from ipcomp_scratches if (!scratches) return; for_each_possible_cpu(i) vfree(*per_cpu_ptr(scratches, i)); Trying to free non existent page, causing warning: trying to vfree existent vm area. ... } Fix this breakage by updating ipcomp_scrtches with NULL when scratches is freed

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

+0.01 pp

From 0.16% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu119 products
  • linuxAll versions (No fix recorded) | < 4.15.0-204.215 | < 5.4.0-139.156 | < 5.15.0-60.66
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1150.163 | < 5.4.0-1096.104 | < 5.15.0-1030.34
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.0.3-1
Linux1 product
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < debca61df6bc2f65e020656c9c5b878d6b38d30f | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a39f456d62810c0efb43cead22f98d95b53e4b1a | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1e8abde895b3ac6a368cbdb372e8800c49e73a28 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 18373ed500f7cd53e24d9b0bd0f1c09d78dba87e | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < be81c44242b20fc3bdcc73480ef8aaee56f5d0b6 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 03155680191ef0f004b1d6a5714c5b8cd271ab61 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f3bdba4440d82e0da2b1bfc35d3836c8a8e00677 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2c19945ce8095d065df550e7fe350cd5cc40c6e6 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8a04d2fc700f717104bfb95b0f6694e448a4537f | 2.6.12

3 vendors · 121 products

References

13 links
Show all 13 references