Skip to content
OpenAdvisories
High · 7.8 CVE-2022-50569 EUVD-2022-55659GHSA-h9qx-33jg-gh24

xfrm: Update ipcomp_scratches with NULL when freed

Published Oct 22, 2025 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.4 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lts-xenial Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Update ipcomp_scratches with NULL when freed

Currently if ipcomp_alloc_scratches() fails to allocate memory
ipcomp_scratches holds obsolete address. So when we try to free the
percpu scratches using ipcomp_free_scratches() it tries to vfree non
existent vm area. Described below:

static void * __percpu *ipcomp_alloc_scratches(void)
{
...
scratches = alloc_percpu(void *);
if (!scratches)
return NULL;
ipcomp_scratches does not know about this allocation failure.
Therefore holding the old obsolete address.
...
}

So when we free,

static void ipcomp_free_scratches(void)
{
...
scratches = ipcomp_scratches;
Assigning obsolete address from ipcomp_scratches

if (!scratches)
return;

for_each_possible_cpu(i)
vfree(*per_cpu_ptr(scratches, i));
Trying to free non existent page, causing warning: trying to vfree
existent vm area.
...
}

Fix this breakage by updating ipcomp_scrtches with NULL when scratches
is freed

Affected products

VendorProductAffectedFixed
Linux Linux 2.6.12 4.9.331

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.0.3-1 —
Debian 13 linux 6.0.3-1 —
Debian 12 linux 6.0.3-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1014.16 —
Ubuntu 24.04 LTS linux-riscv +8 No fix yet —
Ubuntu 22.04 LTS linux +1 5.15.0-60.66 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1030.34 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1033.40 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1033.40.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1029.36 —
Ubuntu 22.04 LTS linux-gke 5.15.0-1027.32 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1015.19 —
Ubuntu 22.04 LTS linux-ibm 5.15.0-1025.28 —
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1025.30 —
Ubuntu 22.04 LTS linux-kvm 5.15.0-1028.33 —
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1017.17 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1029.35 —
Ubuntu 22.04 LTS linux-raspi 5.15.0-1024.26 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux 5.4.0-139.156 —
Ubuntu 20.04 LTS linux-aws 5.4.0-1096.104 —
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1030.34~20.04.1 —
Ubuntu 20.04 LTS linux-azure 5.4.0-1103.109 —
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1033.40~20.04.1 —
Ubuntu 20.04 LTS linux-bluefield 5.4.0-1058.64 —
Ubuntu 20.04 LTS linux-gcp 5.4.0-1100.109 —
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1029.36~20.04.1 —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-hwe-5.15 +1 5.15.0-60.66~20.04.1 —
Ubuntu 20.04 LTS linux-ibm 5.4.0-1044.49 —
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1025.30~20.04.1 —
Ubuntu 20.04 LTS linux-iot 5.4.0-1012.14 —
Ubuntu 20.04 LTS linux-kvm 5.4.0-1086.92 —
Ubuntu 20.04 LTS linux-oracle 5.4.0-1093.102 —
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1029.35~20.04.1 —
Ubuntu 20.04 LTS linux-raspi 5.4.0-1080.91 —
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1029.33~20.04.1 —
Ubuntu 20.04 LTS linux-xilinx-zynqmp 5.4.0-1021.25 —
Ubuntu 18.04 LTS linux 4.15.0-204.215 —
Ubuntu 18.04 LTS linux-aws 4.15.0-1150.163 —
Ubuntu 18.04 LTS linux-aws-5.4 5.4.0-1096.104~18.04.1 —
Ubuntu 18.04 LTS linux-azure-4.15 4.15.0-1161.176 —
Ubuntu 18.04 LTS linux-azure-5.4 5.4.0-1103.109~18.04.1 —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 18.04 LTS linux-gcp-4.15 4.15.0-1145.161 —
Ubuntu 18.04 LTS linux-gcp-5.4 5.4.0-1100.109~18.04.1 —
Ubuntu 18.04 LTS linux-hwe-5.4 5.4.0-139.156~18.04.1 —
Ubuntu 18.04 LTS linux-ibm-5.4 5.4.0-1044.49~18.04.1 —
Ubuntu 18.04 LTS linux-kvm 4.15.0-1135.140 —
Ubuntu 18.04 LTS linux-oracle 4.15.0-1114.125 —
Ubuntu 18.04 LTS linux-oracle-5.4 5.4.0-1093.102~18.04.1 —
Ubuntu 18.04 LTS linux-raspi-5.4 5.4.0-1080.91~18.04.1 —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-aws-fips 5.4.0-1096.104+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-azure-fips 5.4.0-1103.109+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips 5.4.0-1072.81 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-gcp-fips 5.4.0-1100.109+fips1 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-aws-fips 4.15.0-2089.95 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-azure-fips 4.15.0-2070.76 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips 4.15.0-1107.118 —
Ubuntu Pro FIPS-updates 18.04 LTS linux-gcp-fips 4.15.0-2054.59 —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips No fix yet —
Ubuntu Pro 16.04 LTS linux +2 No fix yet —
Ubuntu Pro 16.04 LTS linux-aws-hwe 4.15.0-1151.164~16.04.1 —
Ubuntu Pro 16.04 LTS linux-azure 4.15.0-1162.177~16.04.1 —
Ubuntu Pro 16.04 LTS linux-gcp 4.15.0-1146.162~16.04.1 —
Ubuntu Pro 16.04 LTS linux-hwe 4.15.0-206.217~16.04.1 —
Ubuntu Pro 16.04 LTS linux-oracle 4.15.0-1115.126~16.04.1 —
Ubuntu Pro 14.04 LTS linux +2 No fix yet —
Ubuntu Pro 14.04 LTS linux-azure 4.15.0-1162.177~14.04.1 —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.0.0-284.11.1.el9_2 RHSA-2023:2458
RHEL 9 perf +48 5.14.0-284.11.1.el9_2 RHSA-2023:2458
RHEL 8 perf +26 4.18.0-477.10.1.el8_8 RHSA-2023:2951
ReleasePackageFixed inAdvisory
SLES 12 SP5 kernel-syms +2 4.12.14-122.283.1 SUSE-SU-2025:4515-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Live Patching 12 SP5 kernel-default 4.12.14-122.283.1 SUSE-SU-2025:4515-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_75 1-8.3.1 SUSE-SU-2025:4515-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 kernel-livepatch-4.14.296-222.539 1.0-0.amzn2 ALAS2-2022-1876
Amazon Linux 2 perf +8 4.14.296-222.539.amzn2 ALAS2-2022-1876

Advisories 6

References