CVE-2022-50669 misc: ocxl: fix possible name leak in ocxl_file_register_afu()
A memory leak in the Linux kernel OCXL driver allows local attackers to potentially read sensitive kernel memory or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50669?
CVE-2022-50669 is a memory corruption vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
misc: ocxl: fix possible name leak in ocxl_file_register_afu()
If device_register() returns error in ocxl_file_register_afu(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and info is freed in info_release().
Which versions are affected by CVE-2022-50669?
How do I fix CVE-2022-50669?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50669 being exploited?
There is no known exploitation of CVE-2022-50669 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50669, GHSA-ffpg-m95f-r6q9, UBUNTU-CVE-2022-50669.