CVE-2022-50284: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50284 is a memory leak vulnerability in the Linux kernel's IPC message queue subsystem, specifically in the init_mqueue_fs() function. When setup_mq_sysctls() fails during initialization, the mqueue_inode_cachep slab cache is not properly released, resulting in a kernel memory leak (CWE-401). The vulnerability affects Linux kernel versions 5.19 through 6.0.15 and 6.1 through 6.1.1. It was publicly disclosed on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In init_mqueue_fs(), if the call to setup_mq_sysctls() returns an error, the code path exits without invoking the appropriate cleanup for mqueue_inode_cachep, which was allocated earlier in the initialization sequence. The fix reorders the release path so that mqueue_inode_cachep is properly destroyed on failure. Exploitation requires local access with low privileges, as the condition is triggered during kernel module initialization rather than through a user-controlled code path (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation could allow a local attacker with low privileges to cause gradual memory exhaustion in the kernel, leading to degraded system performance or denial of service over time. The vulnerability has no confidentiality or integrity impact; the sole consequence is high availability impact through resource exhaustion. Affected systems running vulnerable kernel versions (5.19–6.0.15 or 6.1–6.1.1) may experience instability if the memory leak is repeatedly triggered (Red Hat Advisory).

There is no known public proof-of-concept exploit for CVE-2022-50284, and no evidence of in-the-wild exploitation has been observed. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is associated with this issue (Red Hat Advisory).

The fix is available in Linux kernel versions 6.0.16 and 6.1.2, which reorder the cleanup path in init_mqueue_fs() to ensure mqueue_inode_cachep is released on setup_mq_sysctls() failure. Users should update their kernel to 6.0.16 or 6.1.2 (or later) via their distribution's official package repositories. As a secondary measure, restricting local system access to minimize the number of users who can trigger kernel initialization paths is advisable (Red Hat Bugzilla, Kernel Patch 6.0.x, Kernel Patch 6.1.x).