What’s Vulnerable › Vulnerabilities

CVE-2022-50389: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-18 · updated 2026-06-17
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so the TPM2 table is not used after the init, should be freed, call acpi_put_table() to fix the memory leak.

Affected products

• Linux kernel: from 4.0 before 4.14.303; from 4.15 before 4.19.270; from 4.20 before 5.4.229; from 5.5 before 5.10.163; from 5.11 before 5.15.87; from 5.16 before 6.0.17 — fixed in 4.14.303, 4.19.270, 5.10.163, 5.15.87, 5.4.229, 6.0.17

How to fix

Upgrade to a fixed version: Linux kernel 4.14.303, 4.19.270, 5.10.163, 5.15.87. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/08fd965521d0e172d540cf945517810895fcb199
• https://git.kernel.org/stable/c/0bd9b4be721c776f77adcaf34105dfca3007ddb9
• https://git.kernel.org/stable/c/1af2232b13837ce0f3a082b9f43735b09aafc367
• https://git.kernel.org/stable/c/2fcd3dc8b97a14f1672729c86b7041a1a89b052a
• https://git.kernel.org/stable/c/37e90c374dd11cf4919c51e847c6d6ced0abc555
• https://git.kernel.org/stable/c/927860dfa161ae8392a264197257dbdc52b26b0f
• https://git.kernel.org/stable/c/986cd9a9b95423e35a2cbb8e9105aec0e0d7f337
• https://git.kernel.org/stable/c/b0785edaf649e5f04dc7f75533e810f4c00e4106

Get alerted when CVE-2022-50389 or the next vulnerability affects your stack