In the Linux kernel, the following vulnerability has been resolved: ima: Fix memory leak in __ima_inode_hash() Commit f3cc6b25dcc5 ("ima: always measure and audit files in policy") lets measurement or audit happen even if the file digest cannot be calculated. As a result, iint->ima_hash could have been allocated despite ima_collect_measurement() returning an error. Since ima_hash belongs to a temporary inode metadata structure, declared at the beginning of __ima_inode_hash(), just add a kfree() call if ima_collect_measurement() returns an error different from -ENOMEM (in that case, ima_hash should not have been allocated).

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/8c1d6a050a0f16e0a9d32eaf53b965c77279c6f8 cve-icon cve-icon
https://git.kernel.org/stable/c/c4df8cb38f139ed9f4296868c0a6f15a26e8c491 cve-icon cve-icon
https://git.kernel.org/stable/c/f375bcf69f58fd0744c9dfd1b6b891a27301d67b cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025102209-CVE-2022-50577-ebe1@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50577 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50577 cve-icon
History

Thu, 23 Oct 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 23 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 22 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ima: Fix memory leak in __ima_inode_hash() Commit f3cc6b25dcc5 ("ima: always measure and audit files in policy") lets measurement or audit happen even if the file digest cannot be calculated. As a result, iint->ima_hash could have been allocated despite ima_collect_measurement() returning an error. Since ima_hash belongs to a temporary inode metadata structure, declared at the beginning of __ima_inode_hash(), just add a kfree() call if ima_collect_measurement() returns an error different from -ENOMEM (in that case, ima_hash should not have been allocated).
Title ima: Fix memory leak in __ima_inode_hash()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-10-22T13:23:30.910Z

Updated: 2025-10-22T13:23:30.910Z

Reserved: 2025-10-22T13:20:23.761Z

Link: CVE-2022-50577

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-22T14:15:42.677

Modified: 2025-10-22T21:12:48.953

Link: CVE-2022-50577

cve-icon Redhat

Severity : Low

Publid Date: 2025-10-22T00:00:00Z

Links: CVE-2022-50577 - Bugzilla