CVE-2022-49627

In the Linux kernel, the following vulnerability has been resolved:

ima: Fix potential memory leak in ima_init_crypto()

On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the ima_algo_array. Add the missing kfree() for ima_algo_array to avoid the potential memory leak.

This vulnerability is rated with a Moderate severity because it is restricted to an error recovery failure during early kernel boot, requiring specific cryptographic resource allocation failures rather than being exploitable during routine local user operations. During system startup, if the Integrity Measurement Architecture fails to initialize its cryptographic transformation structures, allocated algorithm metadata is not deallocated. Because this condition only triggers once during initial subsystem boot under severe memory constraints, it does not present an ongoing runtime leak or allow arbitrary privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.