What’s Vulnerable › Vulnerabilities

CVE-2022-49566: crypto: qat - fix memory leak in RSA

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix memory leak in RSA When an RSA key represented in form 2 (as defined in PKCS #1 V2.1) is used, some components of the private key persist even after the TFM is released. Replace the explicit calls to free the buffers in qat_rsa_exit_tfm() with a call to qat_rsa_clear_ctx() which frees all buffers referenced in the TFM context.

Affected products

• Linux kernel: from 4.8 before 5.15.58; from 5.16 before 5.18.15 — fixed in 5.15.58, 5.18.15

How to fix

Upgrade to a fixed version: Linux kernel 5.15.58, 5.18.15. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0f967fdc09955221a1951a279481b0bf4d359941
• https://git.kernel.org/stable/c/80a52e1ee7757b742f96bfb0d58f0c14eb6583d0
• https://git.kernel.org/stable/c/a843925e0287eebb4aa808666bf22c664dfe4c53

Get alerted when CVE-2022-49566 or the next vulnerability affects your stack