CVE-2022-50561 iio: fix memory leak in iio_device_register_eventset()
A memory leak in the Linux kernel IIO subsystem allows local attackers to exhaust system memory, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50561?
CVE-2022-50561 is a memory corruption vulnerability in Linux, published on 22 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iio: fix memory leak in iio_device_register_eventset()
When iio_device_register_sysfs_group() returns failed, iio_device_register_eventset() needs to free attrs array.
Otherwise, kmemleak would scan & report memory leak as below:
unreferenced object 0xffff88810a1cc3c0 (size 32): comm "100-i2c-vcnl302", pid 728, jiffies 4295052307 (age 156.027s) backtrace: __kmalloc+0x46/0x1b0 iio_device_register_eventset at drivers/iio/industrialio-event.c:541 __iio_device_register at drivers/iio/industrialio-core.c:1959 __devm_iio_device_register at drivers/iio/industrialio-core.c:2040
Which versions are affected by CVE-2022-50561?
How do I fix CVE-2022-50561?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50561 being exploited?
There is no known exploitation of CVE-2022-50561 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50561, GHSA-9xgm-4j53-mch4, UBUNTU-CVE-2022-50561.