CVE-2022-50463: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50463 is a resource leak vulnerability in the Linux kernel's PowerPC/52xx subsystem, specifically in the mpc52xx_lpbfifo_probe() function. The error handling path calls request_irq() without a corresponding free_irq(), causing IRQ resources to not be released on probe failure. It affects Linux kernel versions from 2.6.33 through 6.1.1 across multiple stable branches. The CVE was published on October 1, 2025, with CVSS v3.1 analysis completed in January 2026, yielding a base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), specifically an IRQ resource leak rather than a memory leak in the traditional sense. In mpc52xx_lpbfifo_probe(), when an error occurs during driver initialization, the function exits without calling free_irq() to release the interrupt previously registered via request_irq(). This imbalance means each failed probe attempt permanently consumes an IRQ resource. Exploitation requires local access and the ability to trigger repeated probe failures of the mpc52xx_lpbfifo driver, which is specific to PowerPC MPC52xx-based embedded hardware (Feedly).

The primary impact is availability: a local attacker with sufficient privileges on an affected PowerPC/MPC52xx system could repeatedly trigger probe failures to exhaust available IRQ resources, leading to denial of service and system instability. There is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized modification. The scope is limited to systems running the mpc52xx_lpbfifo driver on PowerPC 52xx embedded hardware, significantly narrowing the affected population (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033%, reflecting very low probability of exploitation. Exploitation is further constrained by the requirement for local access on niche PowerPC/MPC52xx embedded hardware, making opportunistic exploitation highly unlikely.

Update to a patched Linux kernel version: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, or 6.1.2, all of which include the fix (kernel.org patches). For systems that cannot be immediately patched, restrict local user access and consider disabling or blacklisting the mpc52xx_lpbfifo kernel module if it is not required for system functionality. Given the hardware-specific nature of this vulnerability, only systems running on PowerPC MPC52xx platforms are at risk (Feedly).