CVE-2022-50395: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50395 is a memory leak vulnerability in the Linux kernel's integrity subsystem, specifically in the integrity_init_keyring() function. When keyring allocation fails, the previously allocated key restriction object is not freed, resulting in a memory leak. The vulnerability affects Linux kernel versions 4.12 through 5.4.228, 5.5 through 5.10.162, 5.11 through 5.15.85, 5.16 through 6.0.15, and 6.1 through 6.1.1. It was published on September 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In integrity_init_keyring(), a key restriction structure is allocated before the keyring itself is created; if the keyring allocation subsequently fails, the error path returns without freeing the key restriction, leaking kernel memory. Exploitation requires local access with low privileges and no user interaction. No public proof-of-concept or technical write-up beyond the kernel commit descriptions is currently available (Red Hat Advisory).

The primary impact is on system availability: a local attacker with low-privilege access could repeatedly trigger the error path to gradually exhaust kernel memory, potentially degrading system performance or causing resource depletion. There is no confidentiality or integrity impact associated with this vulnerability. The scope is limited to the local system, with no known potential for lateral movement or data exposure (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

Apply the patched kernel versions released by the Linux kernel stable team: 5.4.229, 5.10.163, 5.15.86, 6.0.16, or 6.1.2 and later. Distribution-specific updates are available from Red Hat and SUSE (SUSE-SU-2025:03628-1, SUSE-SU-2025:3716-1). As a general mitigation, restrict local user access to critical systems and monitor system memory usage for unusual patterns. Upstream patches are available at the kernel.org stable repository (Red Hat Bugzilla, kernel.org Patch).