CVE-2022-50287 drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs
A memory leak in the Linux kernel's i915 driver can lead to undefined behavior or resource exhaustion, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50287?
CVE-2022-50287 is a medium-severity memory corruption vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs
When (size != 0 || ptrs->lvds_ entries != 3), the program tries to free() the ptrs. However, the ptrs is not created by calling kzmalloc(), but is obtained by pointer offset operation. This may lead to memory leaks or undefined behavior.
Fix this by replacing the arguments of kfree() with ptrs_block.
(cherry picked from commit 7674cd0b7d28b952151c3df26bbfa7e07eb2b4ec)
Weakness: CWE-401
Which versions are affected by CVE-2022-50287?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50287?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50287 being exploited?
There is no known exploitation of CVE-2022-50287 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50287, GHSA-qmp7-w9r2-h28j, UBUNTU-CVE-2022-50287.