CVE-2022-50751 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
configfs: fix possible memory leak in configfs_create_dir()
kmemleak reported memory leaks in configfs_create_dir():
unreferenced object 0xffff888009f6af00 (size 192): comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163) configfs_register_subsystem (fs/configfs/dir.c:1857) basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ...
unreferenced object 0xffff888003ba7180 (size 96): comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194) configfs_make_dirent (fs/configfs/dir.c:248) configfs_create_dir (fs/configfs/dir.c:296) configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852) configfs_register_subsystem (fs/configfs/dir.c:1881) basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ...
This is because the refcount is not correct in configfs_make_dirent(). For normal stage, the refcount is changing as:
configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() configfs_new_dirent() # set s_count = 1 dentry->d_fsdata = configfs_get(sd); # s_count = 2 ... configfs_unregister_subsystem() configfs_remove_dir() remove_dir() configfs_remove_dirent() # s_count = 1 dput() ... *dentry_unlink_inode()* configfs_d_iput() # s_count = 0, release
However, if we failed in configfs_create():
configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() # s_count = 2 ... configfs_create() # fail ->out_remove: configfs_remove_dirent(dentry) configfs_put(sd) # s_count = 1 return PTR_ERR(inode);
There is no inode in the error path, so the configfs_d_iput() is lost and makes sd and fragment memory leaked.
To fix this, when we failed in configfs_create(), manually call configfs_put(sd) to keep the refcount correct.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability described in CVE-2022-50751 resides within the Linux kernel's configfs implementation, specifically in the configfs_create_dir() function. This memory leak occurs during the initialization of configfs subsystems and represents a classic case of improper reference counting in kernel memory management. The issue manifests when the configfs subsystem fails during its creation phase, leading to unreferenced memory objects that remain allocated in the kernel's memory space. The vulnerability was identified through kmemleak analysis, which detected two distinct memory leaks with sizes of 192 bytes and 96 bytes respectively, both originating from the configfs directory creation process.
The technical flaw stems from incorrect reference counting logic within the configfs_make_dirent() function, which is called during configfs_create_dir(). Under normal operational conditions, the reference count management follows a predictable pattern where s_count transitions from 1 to 2 and back to 0 through proper sequence of function calls including configfs_get() and configfs_put(). However, when configfs_create() fails during the subsystem registration process, the error handling path does not properly account for the reference count, leaving the s_count at 1 instead of decrementing to 0. This discrepancy occurs because the error path returns early without invoking the normal cleanup sequence that would normally call configfs_d_iput(), which is responsible for releasing the memory when s_count reaches zero.
The operational impact of this vulnerability extends beyond simple memory consumption, as it represents a potential vector for resource exhaustion attacks against systems running affected kernel versions. The memory leaks accumulate during system initialization phases, particularly when modules using configfs are loaded through modprobe, making this vulnerability particularly concerning for embedded systems or environments where memory resources are constrained. The vulnerability affects systems where configfs subsystems are registered during kernel module initialization, creating a persistent memory leak that can grow over time and potentially impact system stability or performance.
The fix implemented addresses the root cause by ensuring proper reference count management during error conditions. When configfs_create() fails, the solution introduces an explicit configfs_put(sd) call to maintain correct reference counting, preventing the memory leak from occurring. This approach aligns with established kernel development practices for managing reference counts in error paths and follows the principle of ensuring that every acquisition of a reference has a corresponding release, regardless of execution path. The mitigation strategy specifically targets the failure scenario in configfs_register_subsystem() where configfs_create() returns an error, ensuring that the reference count is properly decremented before the function returns, thus preventing the memory leak from occurring.
This vulnerability maps to CWE-401: Improper Release of Memory Before Next Ref, which specifically addresses memory leaks resulting from improper reference counting in kernel space. The attack surface is primarily through legitimate kernel module loading operations, making it a low-privilege but potentially persistent threat. The ATT&CK framework would categorize this under T1059.003: Command and Scripting Interpreter - PowerShell, though more accurately it represents a kernel-level memory management vulnerability that could be exploited in conjunction with other techniques to exhaust system resources. The vulnerability demonstrates the importance of comprehensive error handling in kernel code and proper reference counting practices in kernel memory management, particularly in subsystems that manage complex object hierarchies like configfs.