CVE-2022-50201: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50201 is a memory leak vulnerability in the Linux kernel's SELinux subsystem, specifically in the security_read_state_kernel() function. When __security_read_policy fails, the function returns the error result directly without freeing the memory previously allocated in *data, causing a memory leak. The vulnerability affects Linux kernel versions 5.12 to 5.15.60, 5.16 to 5.18.17, and 5.19 to 5.19.1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patch).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In security_read_state_kernel(), the function allocates a buffer for *data and then calls __security_read_policy. If that call fails, the function returns the error code immediately without calling kfree() on the allocated buffer, resulting in a kernel memory leak. Exploitation requires local access with low privileges, as an attacker would need to repeatedly trigger the failure path to exhaust kernel memory over time (Feedly, Kernel Patch).

Successful exploitation of this vulnerability by a low-privileged local attacker could cause a denial of service by gradually exhausting kernel memory, degrading or halting system availability. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The affected scope is the local system only, with no potential for lateral movement or data exposure (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across the affected stable branches. Users should update to kernel version 5.15.61 or later (for the 5.12–5.15.x branch), 5.18.18 or later (for the 5.16–5.18.x branch), or 5.19.2 or later (for the 5.19.x branch). Patches are available via the upstream stable kernel repository. As a general workaround, limiting local user access to reduce the attack surface is advisable until patching is complete (Kernel Patch, Kernel Patch, Kernel Patch).