CVE-2022-50234: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50234 is a Linux kernel vulnerability in the io_uring and af_unix subsystems related to improper handling of registered file garbage collection (GC) during cycle detection and release. The flaw involves how unix_gc() interacts with io_uring's registered files — specifically, files were being released prematurely rather than deferred to io_uring's own release path (io_ring_ctx_free()), potentially causing a socket buffer (skb) leak and unexpected reference manipulation. It was publicly disclosed on September 15, 2025, and affects Linux kernel versions 5.1.x through 5.4.219, 5.5.x through 5.10.149, 5.11.x through 5.15.74, 5.16.x through 5.19.16, and 6.0.x through 6.0.2. The CVSS v3.1 base score is 7.8 (High), reflecting a local attack vector with low privileges required (Red Hat CVE, Feedly).

The root cause is a use-after-free or improper reference counting flaw (related to CWE-416 / CWE-911) in the interaction between the Unix domain socket garbage collector (unix_gc()) and io_uring's registered file management. When unix_gc() processes io_uring-registered files during cycle detection, it incorrectly releases file references that should instead be handled by io_uring's own release path. The fix defers GC of registered files to io_uring's release mechanism: registered files are considered for cycle detection but not released by unix_gc(), allowing io_uring to remove all references to the ring file and trigger ->release → io_ring_ctx_free() cleanly. An additional skb (socket buffer) leak was also folded into the fix. Exploitation requires local access with low privileges — an attacker must be able to create io_uring instances and register files with Unix domain sockets (Red Hat CVE, Feedly).

Successful exploitation could allow a local, low-privileged attacker to manipulate file reference counts in the kernel, potentially leading to use-after-free conditions that compromise system confidentiality, integrity, and availability. The CVSS scoring reflects high impact across all three pillars, meaning an attacker could potentially read sensitive kernel memory, corrupt kernel data structures, or cause a denial of service (kernel panic/crash). The vulnerability is confined to the local system (scope unchanged), but on multi-tenant or shared systems, it could be leveraged for privilege escalation (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported. Qualys has added detection for this vulnerability (detection ID 759794) (Feedly).

Apply the upstream kernel patches available for all affected stable branches. Fixed versions include: 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (mainline). Patches are available via the stable kernel tree at git.kernel.org (Feedly). SUSE has also released updated kernel packages addressing this CVE (advisories SUSE-2025-03613-1, SUSE-2025-03628-1, SUSE-2025-3716-1). As a workaround where patching is not immediately possible, restrict local user access to io_uring via seccomp filters or by setting kernel.io_uring_disabled=1 (available on kernels that support this sysctl), and enforce least-privilege access controls (Red Hat CVE).

Red Hat has tracked this vulnerability and assigned it a CVSS v3.1 score of 7.8 (High) via their security advisory portal (Red Hat CVE). SUSE issued multiple kernel update advisories addressing this CVE in their enterprise Linux products. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.