CVE-2022-49546
x86/kexec: fix memory leak of elf header buffer
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: x86/kexec: fix memory leak of elf header buffer This is reported by kmemleak detector: unreferenced object 0xffffc900002a9000 (size 4096): comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s) hex dump (first 32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00 ..>............. backtrace: [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170 [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160 [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0 [<0000000019afff23>] crash_load_segments+0x260/0x470 [<0000000019ebe95c>] bzImage64_load+0x814/0xad0 [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0 [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0 [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530 [<0000000087c19992>] do_syscall_64+0x3b/0x90 [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to store elf headers. While it's not freed back to system correctly when kdump kernel is reloaded or unloaded. Then memory leak is caused. Fix it by introducing x86 specific function arch_kimage_file_post_load_cleanup(), and freeing the buffer there. And also remove the incorrect elf header buffer freeing code. Before calling arch specific kexec_file loading function, the image instance has been initialized. So 'image->elf_headers' must be NULL. It doesn't make sense to free the elf header buffer in the place. Three different people have reported three bugs about the memory leak on x86_64 inside Redhat.
Timeline
ID reserved
By Linux
Published
- 15 months later
· 15 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.28% · top 80% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Weakness
Affected products
- affected dd5f726076cc7639d9713b334c8c133f77c6757a – < 23cf39dccf7653650701a6f39b119e9116a27f1a
- affected dd5f726076cc7639d9713b334c8c133f77c6757a – < 8765a423a87d74ef24ea02b43b2728fe4039f248
- affected dd5f726076cc7639d9713b334c8c133f77c6757a – < 115ee42a4c2f26ba2b4ace2668a3f004621f6833
- affected dd5f726076cc7639d9713b334c8c133f77c6757a – < f675e3a9189d84a9324ab45b0cb19906c2bc8fcb
- affected dd5f726076cc7639d9713b334c8c133f77c6757a – < b3e34a47f98974d0844444c5121aaff123004e57
- affected 3.17
- unaffected < 3.17
- unaffected 5.10.236 – ≤ 5.10.*
- unaffected 5.15.46 – ≤ 5.15.*
- unaffected 5.17.14 – ≤ 5.17.*
- unaffected 5.18.3 – ≤ 5.18.*
- unaffected 5.19 – ≤ *
References (6)
- https://git.kernel.org/stable/c/23cf39dccf7653650701a6f39b119e9116a27f1a (opens in a new tab)
- https://git.kernel.org/stable/c/8765a423a87d74ef24ea02b43b2728fe4039f248 (opens in a new tab)
- https://git.kernel.org/stable/c/115ee42a4c2f26ba2b4ace2668a3f004621f6833 (opens in a new tab)
- https://git.kernel.org/stable/c/f675e3a9189d84a9324ab45b0cb19906c2bc8fcb (opens in a new tab)
- https://git.kernel.org/stable/c/b3e34a47f98974d0844444c5121aaff123004e57 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-49546)Record last updated .