CVE-2022-50431: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50431 is a memory leak vulnerability in the Linux kernel's ALSA AOA i2sbus driver, specifically within the i2sbus_add_dev() function. When dev_set_name() allocates memory for a device name and the subsequent of_device_register() call fails, the allocated memory is not properly released, resulting in a persistent memory leak. The vulnerability affects Linux kernel versions from 2.6.18 through multiple stable branches up to (but not including) 4.9.332, 4.14.298, 4.19.264, 5.4.223, 5.10.153, 5.15.77, 6.0.7, and 6.1-rc2. It was published on October 1, 2025, with NVD initial analysis completed January 20, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (RedHat CVE, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In soundbus_add_one(), dev_set_name() allocates heap memory for the device name string. If of_device_register() subsequently fails, the code path does not call soundbus_dev_put() to release the reference held by device_initialize(), preventing kobject_cleanup() from freeing the memory when the reference count reaches zero. The fix involves calling soundbus_dev_put() on the error path so that i2sbus_release_dev() can properly clean up all associated resources. Exploitation requires local access with low privileges to trigger the error condition in the driver (RedHat CVE, Feedly).

Successful exploitation of this vulnerability is limited to availability impact — specifically, a local attacker with low privileges could repeatedly trigger the memory leak to gradually exhaust kernel memory resources, potentially leading to system instability, performance degradation, or a denial-of-service condition. There is no confidentiality or integrity impact, and the scope is unchanged (confined to the affected system). The vulnerability does not enable lateral movement or data exfiltration (RedHat CVE, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported (Feedly).

Apply the available kernel patches for the relevant stable branches. Fixed versions include Linux kernel 4.9.332, 4.14.298, 4.19.264, 5.4.223, 5.10.153, 5.15.77, 6.0.7, and 6.1. Stable kernel commits are available at the kernel.org repository for each affected branch. Administrators should update via their Linux distribution's security repository (e.g., SUSE has issued advisory SUSE-2025-03613-1). As an interim measure, monitor systems for signs of memory exhaustion using tools such as free, vmstat, or kernel memory accounting interfaces (RedHat CVE, Feedly).