{"id":"DEBIAN-CVE-2022-50743","details":"In the Linux kernel, the following vulnerability has been resolved:  erofs: Fix pcluster memleak when its block address is zero  syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed  unreferenced object 0xffff88811009c7f8 (size 136):   ...   backtrace:     [\u003cffffffff821db19b\u003e] z_erofs_do_read_page+0x99b/0x1740     [\u003cffffffff821dee9e\u003e] z_erofs_readahead+0x24e/0x580     [\u003cffffffff814bc0d6\u003e] read_pages+0x86/0x3d0     ...  syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map-\u003em_pa = zero. This makes pcl-\u003eobj.index be zero although pcl is not a inline pcluster.  Then following path adds refcount for grp, but the refcount won't be put because pcl is inline.  z_erofs_readahead()   z_erofs_do_read_page() # for another page     z_erofs_collector_begin()       erofs_find_workgroup()         erofs_workgroup_get()  Since it's illegal for the block address of a non-inlined pcluster to be zero, add check here to avoid registering the pcluster which would be leaked.","modified":"2026-09-01T20:05:01.028787139Z","published":"2025-12-24T13:16:01.020Z","upstream":["CVE-2022-50743"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50743"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50743.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50743.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50743.json"}}],"schema_version":"1.9.0"}