{
  "cveId": "CVE-2022-50631",
  "url": "https://patchblox.com/security/cve/CVE-2022-50631",
  "summary": "CVE-2022-50631 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50631, released December 9, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  RISC-V: kexec: Fix memory leak of fdt buffer  Th...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  RISC-V: kexec: Fix memory leak of fdt buffer  This is reported by kmemleak detector:  unreferenced object 0xff60000082864000 (size 9588):   comm \u0022kexec\u0022, pid 146, jiffies 4294900634 (age 64.788s)   hex dump (first 32 bytes):     d0 0d fe ed 00 00 12 ed 00 00 00 48 00 00 11 40  ...........H...@     00 00 00 28 00 00 00 11 00 00 00 02 00 00 00 00  ...(............   backtrace:     [\u003C00000000f95b17c4\u003E] kmemleak_alloc\u002B0x34/0x3e     [\u003C00000000b9ec8e3e\u003E] kmalloc_order\u002B0x9c/0xc4     [\u003C00000000a95cf02e\u003E] kmalloc_order_trace\u002B0x34/0xb6     [\u003C00000000f01e68b4\u003E] __kmalloc\u002B0x5c2/0x62a     [\u003C000000002bd497b2\u003E] kvmalloc_node\u002B0x66/0xd6     [\u003C00000000906542fa\u003E] of_kexec_alloc_and_setup_fdt\u002B0xa6/0x6ea     [\u003C00000000e1166bde\u003E] elf_kexec_load\u002B0x206/0x4ec     [\u003C0000000036548e09\u003E] kexec_image_load_default\u002B0x40/0x4c     [\u003C0000000079fbe1b4\u003E] sys_kexec_file_load\u002B0x1c4/0x322     [\u003C0000000040c62c03\u003E] ret_from_syscall\u002B0x0/0x2  In elf_kexec_load(), a buffer is allocated via kvmalloc() to store fdt. While it\u0027s not freed back to system when kexec kernel is reloaded or unloaded.  Then memory leak is caused.  Fix it by introducing riscv specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there.",
  "published": "2025-12-09T01:16:44Z",
  "severity": "",
  "epss": 0.00211,
  "epssPercentile": 0.11464,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50631",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50631",
      "released": "2025-12-09T01:16:44Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50631",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50631",
      "released": "2025-12-09T01:16:44Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50631",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50631",
      "released": "2025-12-09T01:16:44Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}