{"id":"DEBIAN-CVE-2022-50751","details":"In the Linux kernel, the following vulnerability has been resolved:  configfs: fix possible memory leak in configfs_create_dir()  kmemleak reported memory leaks in configfs_create_dir():  unreferenced object 0xffff888009f6af00 (size 192):   comm \"modprobe\", pid 3777, jiffies 4295537735 (age 233.784s)   backtrace:     kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273)     new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163)     configfs_register_subsystem (fs/configfs/dir.c:1857)     basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic     do_one_initcall (init/main.c:1296)     do_init_module (kernel/module/main.c:2455)     ...  unreferenced object 0xffff888003ba7180 (size 96):   comm \"modprobe\", pid 3777, jiffies 4295537735 (age 233.784s)   backtrace:     kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273)     configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194)     configfs_make_dirent (fs/configfs/dir.c:248)     configfs_create_dir (fs/configfs/dir.c:296)     configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852)     configfs_register_subsystem (fs/configfs/dir.c:1881)     basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic     do_one_initcall (init/main.c:1296)     do_init_module (kernel/module/main.c:2455)     ...  This is because the refcount is not correct in configfs_make_dirent(). For normal stage, the refcount is changing as:  configfs_register_subsystem()   configfs_create_dir()     configfs_make_dirent()       configfs_new_dirent() # set s_count = 1       dentry-\u003ed_fsdata = configfs_get(sd); # s_count = 2 ... configfs_unregister_subsystem()   configfs_remove_dir()     remove_dir()       configfs_remove_dirent() # s_count = 1     dput() ...       *dentry_unlink_inode()*         configfs_d_iput() # s_count = 0, release  However, if we failed in configfs_create():  configfs_register_subsystem()   configfs_create_dir()     configfs_make_dirent() # s_count = 2     ...     configfs_create() # fail     -\u003eout_remove:     configfs_remove_dirent(dentry)       configfs_put(sd) # s_count = 1       return PTR_ERR(inode);  There is no inode in the error path, so the configfs_d_iput() is lost and makes sd and fragment memory leaked.  To fix this, when we failed in configfs_create(), manually call configfs_put(sd) to keep the refcount correct.","modified":"2026-09-01T20:05:01.012904749Z","published":"2025-12-24T13:16:01.823Z","upstream":["CVE-2022-50751"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50751"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50751.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50751.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50751.json"}}],"schema_version":"1.9.0"}