CVE-2022-50404: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50404 is a memory leak vulnerability in the Linux kernel's framebuffer console (fbcon) driver, specifically in the fbcon_do_set_font() function. When a font-setting operation fails, a buffer that may have been newly allocated by fbcon_set_font() is not properly released, resulting in a missing release of memory after its effective lifetime (CWE-401). The vulnerability was reported by syzbot and disclosed on September 18, 2025, affecting Linux kernel versions 5.15.64–5.15.85, 5.19.6 through pre-6.0, 6.0.x through 6.0.15, and 6.1.0–6.1.1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is a missing kfree() call in the error-handling path of fbcon_do_set_font() (CWE-401). A prior commit (a5a923038d70, "fbdev: fbcon: Properly revert changes when vc_resize() failed") introduced logic to revert changes on failure but overlooked the case where fbcon_set_font() had newly allocated a font data buffer — leaving that buffer unreleased on the failure path. Exploitation requires local access with low privileges; an attacker must be able to trigger repeated font-setting failures via the framebuffer console interface, which is typically accessible to users with access to the virtual console or /dev/fb* devices (Feedly, NVD).

Successful exploitation allows a local low-privileged attacker to cause a denial of service through memory exhaustion by repeatedly triggering font-setting failures in the fbcon driver. The leaked memory accumulates over time, leading to system instability, performance degradation, and potential kernel crashes. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly, NVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term (Feedly).

Patches are available in the following stable Linux kernel releases: 5.15.86+, 6.0.16+, and 6.1.2+. Administrators should update to one of these patched versions as the primary remediation. As a secondary measure, restricting local user access to framebuffer console devices (e.g., /dev/fb*) can reduce exposure on systems where immediate patching is not feasible (Feedly, NVD).

SUSE issued kernel security advisories (SUSE-2025-03628-1 and SUSE-2025-3716-1) addressing this vulnerability among others in their kernel packages. Tenable added detection coverage via Nessus plugin 265509. No significant broader media coverage or notable researcher commentary has been identified for this vulnerability (Feedly).