CVE-2022-50387: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50387 is a memory leak vulnerability in the Linux kernel's hinic network driver, classified under CWE-401 (Missing Release of Memory after Effective Lifetime). When hinic_set_cmdq_depth() fails during hinic_init_cmdqs(), the Command Queue (CMDQ) memory is not properly released, potentially leading to resource exhaustion. The vulnerability affects Linux kernel versions 5.8 through 5.10.152, 5.11 through 5.15.76, 5.16 through 6.0.6, and release candidates 6.1-rc1 and 6.1-rc2. It was published on September 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a missing memory deallocation path (CWE-401) in the hinic network driver's initialization routine. Specifically, when hinic_set_cmdq_depth() returns an error within hinic_init_cmdqs(), the error-handling code path fails to free previously allocated CMDQ memory, resulting in a kernel memory leak. Exploitation requires local access with low privileges, as an attacker would need to trigger the failure condition during driver initialization to cause progressive memory exhaustion. No public proof-of-concept exploit code has been identified (Red Hat CVE, Feedly).

Successful exploitation of this vulnerability could allow a low-privileged local attacker to cause a denial of service by exhausting kernel memory resources over time, potentially leading to system instability or an unresponsive state. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The scope is confined to the affected system and does not enable lateral movement or data exfiltration (Feedly).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Feedly).

Patches have been released for all affected Linux kernel stable branches. Administrators should upgrade to kernel version 5.10.153 or later (for the 5.10.x branch), 5.15.77 or later (for the 5.15.x branch), 6.0.7 or later (for the 6.0.x branch), or the mainline 6.1 release. The fixes are available via the upstream kernel stable tree. As an interim measure, restricting local user access and monitoring system memory usage can reduce risk (Red Hat CVE, kernel.org patch 1, kernel.org patch 2).