CVE-2022-50765 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: kexec: Fix memory leak of elf header buffer
This is reported by kmemleak detector:
unreferenced object 0xff2000000403d000 (size 4096): comm "kexec", pid 146, jiffies 4294900633 (age 64.792s) hex dump (first 32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 f3 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000566ca97c>] kmemleak_vmalloc+0x3c/0xbe
[<00000000979283d8>] __vmalloc_node_range+0x3ac/0x560
[<00000000b4b3712a>] __vmalloc_node+0x56/0x62
[<00000000854f75e2>] vzalloc+0x2c/0x34
[<00000000e9a00db9>] crash_prepare_elf64_headers+0x80/0x30c
[<0000000067e8bf48>] elf_kexec_load+0x3e8/0x4ec
[<0000000036548e09>] kexec_image_load_default+0x40/0x4c
[<0000000079fbe1b4>] sys_kexec_file_load+0x1c4/0x322
[<0000000040c62c03>] ret_from_syscall+0x0/0x2
In elf_kexec_load(), a buffer is allocated via vzalloc() to store elf headers. While it's not freed back to system when kdump kernel is reloaded or unloaded, or when image->elf_header is successfully set and then fails to load kdump kernel for some reason. Fix it by freeing the buffer in arch_kimage_file_post_load_cleanup().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability CVE-2022-50765 represents a memory leak in the Linux kernel's RISC-V implementation related to the kexec functionality used for loading crash dump kernels. This issue manifests through the kmemleak detector which identifies unreferenced memory objects that remain allocated beyond their intended lifecycle. The specific memory leak occurs when the kexec subsystem processes ELF headers during kernel loading operations, creating a persistent memory consumption issue that can degrade system performance over time.
The technical flaw resides in the improper memory management within the elf_kexec_load function where a buffer allocated via vzalloc() to store ELF headers is not consistently freed back to the system. This allocation occurs during the preparation phase for crash dump kernel loading, specifically in the crash_prepare_elf64_headers function that handles ELF64 header processing. The memory leak becomes particularly problematic during kdump kernel reload operations or when the kdump kernel loading process fails after the elf_header has been successfully set, leaving the allocated buffer in an unreferenced state.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it represents a resource exhaustion threat that could potentially lead to system instability. The memory leak affects systems running RISC-V architecture that utilize kexec for crash dump functionality, creating a persistent condition where 4096-byte buffers remain allocated indefinitely. This condition can accumulate over time, particularly in systems that frequently perform kexec operations or crash dump preparations, leading to gradual memory degradation and potential system resource exhaustion.
The fix for this vulnerability implements proper memory cleanup by ensuring the allocated buffer is freed in the arch_kimage_file_post_load_cleanup function, which serves as a centralized cleanup point for kexec operations. This approach follows established memory management best practices and addresses the root cause by ensuring all allocated resources are properly released regardless of the execution path taken during kexec operations. The solution aligns with CWE-401 standards for memory leak prevention and addresses the specific ATT&CK technique of resource exhaustion through improper resource management, ensuring that system memory allocated for crash dump processing is properly reclaimed after use.
This vulnerability demonstrates the critical importance of proper resource management in kernel-level code, particularly in subsystems that handle system-level operations like crash dump preparation. The fix ensures that memory allocated for ELF header processing is consistently freed, preventing the accumulation of unreferenced memory blocks that could eventually impact system stability and performance. The implementation follows standard kernel memory management patterns and maintains compatibility with existing kexec functionality while addressing the specific memory leak condition identified by the kmemleak detector.