---
id: CVE-2022-49256
title: 'watch_queue: Actually free the watch'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  watch_queue: Actually free the watch

  free_watch() does everything barring actually freeing the watch object.  Fix
  this by adding the missing kfree.

  kmemleak produces …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    f69aecb49968e14196366bbe896eab0a904229f5
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    7e8c9b0df07a77f0d072603b8ced2677e30e1893
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    31824613a42aacdcbeb325bf07a1c8247a11ebe2
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    3d8dcf278b1ee1eff1e90be848fa2237db4c07a7
  - Linux 5.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:44:45.180779Z'
published: '2025-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:37.697Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49256'
references:
  - url: 'https://git.kernel.org/stable/c/9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b'
  - url: 'https://git.kernel.org/stable/c/f69aecb49968e14196366bbe896eab0a904229f5'
  - url: 'https://git.kernel.org/stable/c/7e8c9b0df07a77f0d072603b8ced2677e30e1893'
  - url: 'https://git.kernel.org/stable/c/31824613a42aacdcbeb325bf07a1c8247a11ebe2'
  - url: 'https://git.kernel.org/stable/c/3d8dcf278b1ee1eff1e90be848fa2237db4c07a7'
tags:
  - cve.org
epss: 0.00261
epssPercentile: 0.17997
ingestedAt: '2026-11-05T22:38:31.568Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: Actually free the watch

free_watch() does everything barring actually freeing the watch object.  Fix
this by adding the missing kfree.

kmemleak produces a report something like the following.  Note that as an
address can be seen in the first word, the watch would appear to have gone
through call_rcu().

BUG: memory leak
unreferenced object 0xffff88810ce4a200 (size 96):
  comm "syz-executor352", pid 3605, jiffies 4294947473 (age 13.720s)
  hex dump (first 32 bytes):
    e0 82 48 0d 81 88 ff ff 00 00 00 00 00 00 00 00  ..H.............
    80 a2 e4 0c 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8214e6cc>] kmalloc include/linux/slab.h:581 [inline]
    [<ffffffff8214e6cc>] kzalloc include/linux/slab.h:714 [inline]
    [<ffffffff8214e6cc>] keyctl_watch_key+0xec/0x2e0 security/keys/keyctl.c:1800
    [<ffffffff8214ec84>] __do_sys_keyctl+0x3c4/0x490 security/keys/keyctl.c:2016
    [<ffffffff84493a25>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84493a25>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

## Affected

- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 9d92be1a09fbb3dd65600dbfe7eedb40e7228e4b`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < f69aecb49968e14196366bbe896eab0a904229f5`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 7e8c9b0df07a77f0d072603b8ced2677e30e1893`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 31824613a42aacdcbeb325bf07a1c8247a11ebe2`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 3d8dcf278b1ee1eff1e90be848fa2237db4c07a7`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.