CVE-2022-50321: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50321 is a memory leak vulnerability in the brcmfmac WiFi driver of the Linux kernel, specifically in the brcmf_netdev_start_xmit() function. When pskb_expand_head() fails, the function returns NETDEV_TX_OK without freeing the socket buffer (skb), resulting in a memory leak (CWE-401). The vulnerability affects Linux kernel versions from 4.13 through 6.2.x, with fixed versions including 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, and 6.2.3. It was published on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In brcmf_netdev_start_xmit(), when the kernel attempts to expand the head of a packet buffer via pskb_expand_head() and that call fails, the function returns NETDEV_TX_OK to the network stack without invoking dev_kfree_skb() to release the allocated skb. This means the memory associated with the packet buffer is never reclaimed. The fix adds a dev_kfree_skb() call in the failure path to properly release the buffer. Exploitation requires local access with low privileges, and no special user interaction is needed (Red Hat CVE, git.kernel.org).

The primary impact is availability: a local attacker with low privileges could repeatedly trigger the memory leak by sending network traffic through the brcmfmac WiFi interface under conditions that cause pskb_expand_head() to fail, gradually exhausting kernel memory. This can lead to degraded system performance, instability, and potentially a denial-of-service condition as the system runs out of available memory. There is no confidentiality or integrity impact associated with this vulnerability (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-50321. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Qualys (ID: 759788) and Nessus (ID: 270831) (Red Hat CVE).

The primary remediation is to update the Linux kernel to a patched version: 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, or 6.3+. SUSE has released kernel advisories (SUSE-2025-03615-1, SUSE-2025-03628-1, SUSE-2025-3716-1) addressing this issue. For systems that cannot be immediately patched, administrators may consider monitoring kernel memory usage for anomalies or temporarily disabling the brcmfmac WiFi driver if it is not operationally required (Red Hat CVE, SUSE Advisory).