Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-49144: Linux kernel may leak UID memory in io_uring
CVE-2022-49144 · published 1 year ago
Summary
The Linux kernel's io_uring feature could leave user‑ID information in memory when no files are processed, potentially consuming resources over time. This does not affect system security directly but can degrade performance on busy servers. Updating to the latest kernel package from your Linux distribution will apply the fix and stop the leak.
What to do
- Update debian linux to version 5.17.3-1.
- Update linux kernel to version 5.17.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.5, < 5.10.110 >= 5.11, < 5.15.33 >= 5.16, < 5.16.19 >= 5.17, < 5.17.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Debian:12 | debian | linux |
< 5.17.3-1 Fix: upgrade to 5.17.3-1
|
| Linux | linux | kernel |
>= 5.17.0, < 5.17.2 Fix: upgrade to 5.17.2
|
Original advisory text
io_uring: fix memory leak of uid in files registration
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memory leak of uid in files registration When there are no files for __io_sqe_files_scm() to process in the range, it'll free everything and return. However, it forgets to put uid.
References
- https://git.kernel.org/stable/c/0853bd6885c2f293d88aaa7f7f1702c959b31680 URL
- https://security-tracker.debian.org/tracker/CVE-2022-49144 Vendor Advisory
- https://git.kernel.org/stable/c/7fa8b228c3f30060b9f4b24bb9aaaf41b0ae83fe URL
- https://git.kernel.org/stable/c/b27de7011cb3ba14b047be2cee0ed8278368665b URL
- https://git.kernel.org/stable/c/c86d18f4aa93e0e66cda0e55827cd03eea6bc5f8 URL
- https://git.kernel.org/stable/c/d6d7a517e81accf6ed22d55684baea763d2dbe43 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49144... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-49144 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-401Memory Leak
Timeline
Published26 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta