CVE-2022-50107: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50107 is a memory leak vulnerability in the Linux kernel's CIFS (Common Internet File System) implementation when file system caching (fscache) is enabled. The flaw occurs in a specific code path where, upon hitting the index == next_cached condition, a reference count on a struct page is not properly released, resulting in a memory leak. Affected versions include Linux kernel 5.17 (including release candidates), 5.17.1 through 5.18.17, and 5.19 through 5.19.1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patches).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the CIFS fscache read path, when the page index matches the next cached page (index == next_cached), the code fails to release the reference count on the struct page obtained during readahead processing. The fix replaces the problematic page handling with readahead_folio(), which automatically manages the reference count, preventing the leak. Exploitation requires local access with low-privilege permissions and is limited to systems where CIFS mounts are used with fscache enabled (Feedly, Kernel Patches).

Successful exploitation of this vulnerability by a local, low-privileged attacker can cause gradual memory resource exhaustion on the affected system, leading to denial of service through system instability or significant performance degradation. There is no impact on confidentiality or integrity; the impact is limited to availability. The vulnerability affects only systems running vulnerable kernel versions with CIFS mounts and fscache active (Feedly).

There is no public proof-of-concept exploit available for CVE-2022-50107, and no evidence of in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term (Feedly).

Update the Linux kernel to version 5.18.18 or later, or 5.19.2 or later, which include the fix via readahead_folio(). Official patches are available from the Linux kernel stable repositories at three separate commits. As a workaround, disabling CIFS fscache (if not critically required) will prevent the vulnerable code path from being triggered. Administrators should also monitor system memory usage for signs of gradual resource exhaustion on affected systems (Feedly, Kernel Patches).