vulnerability
Ubuntu: (CVE-2022-50043): linux vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:L/Au:S/C:N/I:N/A:C) | Jun 18, 2025 | Jun 26, 2025 | Oct 24, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
net: fix potential refcount leak in ndisc_router_discovery()
The issue happens on specific paths in the function. After both the
object `rt` and `neigh` are grabbed successfully, when `lifetime` is
nonzero but the metric needs change, the function just deletes the
route and set `rt` to NULL. Then, it may try grabbing `rt` and `neigh`
again if above conditions hold. The function simply overwrite `neigh`
if succeeds or returns if fails, without decreasing the reference
count of previous `neigh`. This may result in memory leaks.
Fix it by decrementing the reference count of `neigh` in place.
Solutions
References
- CVE-2022-50043
- https://attackerkb.com/topics/CVE-2022-50043
- URL-https://git.kernel.org/stable/c/7396ba87f1edf549284869451665c7c4e74ecd4f
- URL-https://git.kernel.org/stable/c/7998043d31d000c3a93f46182e6569dd0eecda34
- URL-https://git.kernel.org/stable/c/ffb15594433391fd7885eb88ce5a7f7bdeefbb15
- URL-https://www.cve.org/CVERecord?id=CVE-2022-50043
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.