CVE-2022-50569

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Update ipcomp_scratches with NULL when freed

Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below:

static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about this allocation failure. Therefore holding the old obsolete address. ... }

So when we free,

static void ipcomp_free_scratches(void) { ... scratches = ipcomp_scratches; Assigning obsolete address from ipcomp_scratches

    if (!scratches)
            return;

    for_each_possible_cpu(i)
           vfree(*per_cpu_ptr(scratches, i));

Trying to free non existent page, causing warning: trying to vfree existent vm area. ... }

Fix this breakage by updating ipcomp_scrtches with NULL when scratches is freed

The global ipcomp_scratches could retain a stale pointer when allocation failed or after free, causing ipcomp_free_scratches() to iterate and call vfree() on already-freed/non-existent per-CPU pages—effectively a double free/invalid free leading to warnings or crashes. The fix sets ipcomp_scratches = NULL after free_percpu(scratches), preventing subsequent frees of stale memory. Privileged access to XFRM/IPComp setup is typically required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.