{
  "cveId": "CVE-2022-50316",
  "url": "https://patchblox.com/security/cve/CVE-2022-50316",
  "summary": "CVE-2022-50316 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50316, released September 15, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "orangefs: Fix kmemleak in orangefs_sysfs_init()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  orangefs: Fix kmemleak in orangefs_sysfs_init()  When insert and remove the orangefs module, there are kobjects memory leaked as below:  unreferenced object 0xffff88810f95af00 (size 64):   comm \u0022insmod\u0022, pid 783, jiffies 4294813439 (age 65.512s)   hex dump (first 32 bytes):     a0 83 af 01 81 88 ff ff 08 af 95 0f 81 88 ff ff  ................     08 af 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................   backtrace:     [\u003C0000000031ab7788\u003E] kmalloc_trace\u002B0x27/0xa0     [\u003C000000005a6e4dfe\u003E] orangefs_sysfs_init\u002B0x42/0x3a0     [\u003C00000000722645ca\u003E] 0xffffffffa02780fe     [\u003C000000004232d9f7\u003E] do_one_initcall\u002B0x87/0x2a0     [\u003C0000000054f22384\u003E] do_init_module\u002B0xdf/0x320     [\u003C000000003263bdea\u003E] load_module\u002B0x2f98/0x3330     [\u003C0000000052cd4153\u003E] __do_sys_finit_module\u002B0x113/0x1b0     [\u003C00000000250ae02b\u003E] do_syscall_64\u002B0x35/0x80     [\u003C00000000f11c03c7\u003E] entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0  unreferenced object 0xffff88810f95ae80 (size 64):   comm \u0022insmod\u0022, pid 783, jiffies 4294813439 (age 65.512s)   hex dump (first 32 bytes):     c8 90 0f 02 81 88 ff ff 88 ae 95 0f 81 88 ff ff  ................     88 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................   backtrace:     [\u003C0000000031ab7788\u003E] kmalloc_trace\u002B0x27/0xa0     [\u003C000000001a4841fa\u003E] orangefs_sysfs_init\u002B0xc7/0x3a0     [\u003C00000000722645ca\u003E] 0xffffffffa02780fe     [\u003C000000004232d9f7\u003E] do_one_initcall\u002B0x87/0x2a0     [\u003C0000000054f22384\u003E] do_init_module\u002B0xdf/0x320     [\u003C000000003263bdea\u003E] load_module\u002B0x2f98/0x3330     [\u003C0000000052cd4153\u003E] __do_sys_finit_module\u002B0x113/0x1b0     [\u003C00000000250ae02b\u003E] do_syscall_64\u002B0x35/0x80     [\u003C00000000f11c03c7\u003E] entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0  unreferenced object 0xffff88810f95ae00 (size 64):   comm \u0022insmod\u0022, pid 783, jiffies 4294813440 (age 65.511s)   hex dump (first 32 bytes):     60 87 a1 00 81 88 ff ff 08 ae 95 0f 81 88 ff ff  \u0060...............     08 ae 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................   backtrace:     [\u003C0000000031ab7788\u003E] kmalloc_trace\u002B0x27/0xa0     [\u003C000000005915e797\u003E] orangefs_sysfs_init\u002B0x12b/0x3a0     [\u003C00000000722645ca\u003E] 0xffffffffa02780fe     [\u003C000000004232d9f7\u003E] do_one_initcall\u002B0x87/0x2a0     [\u003C0000000054f22384\u003E] do_init_module\u002B0xdf/0x320     [\u003C000000003263bdea\u003E] load_module\u002B0x2f98/0x3330     [\u003C0000000052cd4153\u003E] __do_sys_finit_module\u002B0x113/0x1b0     [\u003C00000000250ae02b\u003E] do_syscall_64\u002B0x35/0x80     [\u003C00000000f11c03c7\u003E] entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0  unreferenced object 0xffff88810f95ad80 (size 64):   comm \u0022insmod\u0022, pid 783, jiffies 4294813440 (age 65.511s)   hex dump (first 32 bytes):     78 90 0f 02 81 88 ff ff 88 ad 95 0f 81 88 ff ff  x...............     88 ad 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................   backtrace:     [\u003C0000000031ab7788\u003E] kmalloc_trace\u002B0x27/0xa0     [\u003C000000007a14eb35\u003E] orangefs_sysfs_init\u002B0x1ac/0x3a0     [\u003C00000000722645ca\u003E] 0xffffffffa02780fe     [\u003C000000004232d9f7\u003E] do_one_initcall\u002B0x87/0x2a0     [\u003C0000000054f22384\u003E] do_init_module\u002B0xdf/0x320     [\u003C000000003263bdea\u003E] load_module\u002B0x2f98/0x3330     [\u003C0000000052cd4153\u003E] __do_sys_finit_module\u002B0x113/0x1b0     [\u003C00000000250ae02b\u003E] do_syscall_64\u002B0x35/0x80     [\u003C00000000f11c03c7\u003E] entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0  unreferenced object 0xffff88810f95ac00 (size 64):   comm \u0022insmod\u0022, pid 783, jiffies 4294813440 (age 65.531s)   hex dump (first 32 bytes):     e0 ff 67 02 81 88 ff ff 08 ac 95 0f 81 88 ff ff  ..g.............     08 ac 95 0f 81 88 ff ff 00 00 00 00 00 00 00 00  ................   backtrace:     [\u003C0000000031ab7788\u003E] kmalloc_trace\u002B0x27/0xa0     [\u003C000000001f38adcb\u003E] orangefs_sysfs_init\u002B0x291/0x3a0     [\u003C00000000722645ca\u003E] 0xffffffffa02780fe     [\u003C000000004232d9f7\u003E] do_one_initcall\u002B0x87/0x2a0     [\u003C0000000054f22384\u003E] do_init_module\u002B0xdf/0x320     [\u003C000000003263bdea\u003E] load_module\u002B0x2f98/0x3330     [\u003C0000000052cd4153\u003E] __do_sys_finit_module\u002B0x113/0x1b0     [\u003C00000000250ae02b\u003E] do_syscall_64\u002B0x35/ ---truncated---",
  "published": "2025-09-15T15:15:43Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Missing Release of Memory after Effective Lifetime",
  "epss": 0.00157,
  "epssPercentile": 0.04906,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-50316",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50316",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50316",
      "released": "2025-09-15T15:15:43Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50316",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50316",
      "released": "2025-09-15T15:15:43Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50316",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50316",
      "released": "2025-09-15T15:15:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}