LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50289: ocfs2: fix memory leak in ocfs2_stack_glue_init()

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_stack_glue_init() ocfs2_table_header should be free in ocfs2_stack_glue_init() if ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak. BUG: memory leak unreferenced object 0xffff88810eeb5800 (size 128): comm "modprobe", pid 4507, jiffies 4296182506 (age 55.888s) hex dump (first 32 bytes): c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@.............. 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000001e59e1cd>] __register_sysctl_table+0xca/0xef0 [<00000000c04f70f7>] 0xffffffffa0050037 [<000000001bd12912>] do_one_initcall+0xdb/0x480 [<0000000064f766c9>] do_init_module+0x1cf/0x680 [<000000002ba52db0>] load_module+0x6441/0x6f20 [<000000009772580d>] __do_sys_finit_module+0x12f/0x1c0 [<00000000380c1f22>] do_syscall_64+0x3f/0x90 [<000000004cf473bc>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2022-50289 is a Linux kernel OCFS2 memory leak on an initialization failure path. The source describes a leaked 128-byte kernel object during module loading if OCFS2 sysfs setup fails. This looks operationally low urgency unless affected kernels use OCFS2; no active exploitation evidence is provided.

Executive priority

Treat this as a routine kernel hygiene item unless OCFS2 is business-critical in your environment. There is no cited active exploitation or severity score, but affected Linux kernels should still be updated through normal patch cycles.

Technical view

In ocfs2_stack_glue_init(), ocfs2_table_header is not freed when ocfs2_sysfs_init() fails, causing kmemleak to report an unreferenced allocation during modprobe. The listed stable kernel commits correct the error path by freeing the allocation. No CVSS, CWE, exploitability, or impact escalation details are provided.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel builds where the OCFS2 filesystem code is present and its module initialization path is exercised. Organizations not using OCFS2 are less likely to have practical exposure, but kernel package inventory is still needed.

Exploitation context

The bundle does not cite KEV inclusion, public exploitation, exploit code, or weaponized use. The evidence supports a memory leak finding observed by kmemleak during module loading, not confirmed real-world exploitation.

Researcher notes

The public record is sparse: it documents the faulty error path and stable fix commits, but not exploitability, attacker prerequisites, or concrete security impact. Validation should focus on kernel lineage, OCFS2 usage, and whether distribution kernels have backported the fix.

Mitigation direction

  • Identify systems running kernels in the affected version range.
  • Confirm whether OCFS2 is installed, enabled, or loaded.
  • Apply vendor kernel updates containing the listed stable fixes.
  • Check distribution advisories for backported fixes and reboot guidance.
  • If patching is delayed, review vendor guidance for OCFS2-specific mitigations.

Validation and detection

  • Compare running kernel packages against vendor fixed builds.
  • Check whether the ocfs2 module is present or loaded.
  • Review kernel update changelogs for CVE-2022-50289 or the stable commit IDs.
  • After updating, verify hosts boot the corrected kernel.
  • Monitor kernel logs for OCFS2 initialization or memory-leak reports.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50289 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6, 3878f110f71a0971ff7acc15dd6db711b6ef37c6unaffected
LinuxLinux2.6.26, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.