What’s Vulnerable › Vulnerabilities

CVE-2022-49144: io_uring: fix memory leak of uid in files registration

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memory leak of uid in files registration When there are no files for __io_sqe_files_scm() to process in the range, it'll free everything and return. However, it forgets to put uid.

Affected products

• Linux kernel: from 5.5 before 5.10.110; from 5.11 before 5.15.33; from 5.16 before 5.16.19; from 5.17 before 5.17.2 — fixed in 5.10.110, 5.15.33, 5.16.19, 5.17.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.110, 5.15.33, 5.16.19, 5.17.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0853bd6885c2f293d88aaa7f7f1702c959b31680
• https://git.kernel.org/stable/c/7fa8b228c3f30060b9f4b24bb9aaaf41b0ae83fe
• https://git.kernel.org/stable/c/b27de7011cb3ba14b047be2cee0ed8278368665b
• https://git.kernel.org/stable/c/c86d18f4aa93e0e66cda0e55827cd03eea6bc5f8
• https://git.kernel.org/stable/c/d6d7a517e81accf6ed22d55684baea763d2dbe43

Get alerted when CVE-2022-49144 or the next vulnerability affects your stack