In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below: static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about this allocation failure. Therefore holding the old obsolete address. ... } So when we free, static void ipcomp_free_scratches(void) { ... scratches = ipcomp_scratches; Assigning obsolete address from ipcomp_scratches if (!scratches) return; for_each_possible_cpu(i) vfree(*per_cpu_ptr(scratches, i)); Trying to free non existent page, causing warning: trying to vfree existent vm area. ... } Fix this breakage by updating ipcomp_scrtches with NULL when scratches is freed

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00232.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux
  • Linux Kernel
References
Link Providers
https://git.kernel.org/stable/c/03155680191ef0f004b1d6a5714c5b8cd271ab61 cve-icon cve-icon
https://git.kernel.org/stable/c/18373ed500f7cd53e24d9b0bd0f1c09d78dba87e cve-icon cve-icon
https://git.kernel.org/stable/c/1e8abde895b3ac6a368cbdb372e8800c49e73a28 cve-icon cve-icon
https://git.kernel.org/stable/c/2c19945ce8095d065df550e7fe350cd5cc40c6e6 cve-icon cve-icon
https://git.kernel.org/stable/c/8a04d2fc700f717104bfb95b0f6694e448a4537f cve-icon cve-icon
https://git.kernel.org/stable/c/a39f456d62810c0efb43cead22f98d95b53e4b1a cve-icon cve-icon
https://git.kernel.org/stable/c/be81c44242b20fc3bdcc73480ef8aaee56f5d0b6 cve-icon cve-icon
https://git.kernel.org/stable/c/debca61df6bc2f65e020656c9c5b878d6b38d30f cve-icon cve-icon
https://git.kernel.org/stable/c/f3bdba4440d82e0da2b1bfc35d3836c8a8e00677 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025102207-CVE-2022-50569-fdd1@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50569 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50569 cve-icon
History

Tue, 04 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 23 Dec 2025 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Thu, 23 Oct 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 23 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 22 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below: static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about this allocation failure. Therefore holding the old obsolete address. ... } So when we free, static void ipcomp_free_scratches(void) { ... scratches = ipcomp_scratches; Assigning obsolete address from ipcomp_scratches if (!scratches) return; for_each_possible_cpu(i) vfree(*per_cpu_ptr(scratches, i)); Trying to free non existent page, causing warning: trying to vfree existent vm area. ... } Fix this breakage by updating ipcomp_scrtches with NULL when scratches is freed
Title xfrm: Update ipcomp_scratches with NULL when freed
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-04T09:09:27.133Z

Reserved: 2025-10-22T13:20:23.760Z

Link: CVE-2022-50569

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2025-10-22T14:15:41.780

Modified: 2026-06-17T05:23:48.580

Link: CVE-2022-50569

cve-icon Redhat

Severity : Important

Publid Date: 2025-10-22T00:00:00Z

Links: CVE-2022-50569 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-23T10:07:42Z