CVE-2022-50537: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50537 is a vulnerability discovered in the Linux kernel affecting the Raspberry Pi firmware component. The vulnerability was published on October 7, 2025, and involves a potential memory leak in the rpifirmwareprobe() function (NVD, Ubuntu).

The vulnerability occurs in the rpifirmwareprobe() function where if mboxrequestchannel() fails, the 'fw' object will not be freed through rpifirmwaredelete(), resulting in a memory leak. The issue has been assigned a CVSS v3.1 base score of 5.5 with attack vector: Local (L), attack complexity: Low (L), privileges required: Low (L), user interaction: None (N), scope: Unchanged (U), and impact on confidentiality: None (N), integrity: None (N), availability: High (H) (Red Hat).

The vulnerability can lead to memory leaks in the Linux kernel when running on Raspberry Pi hardware. While this doesn't present immediate security risks, it could potentially lead to system resource exhaustion over time if triggered repeatedly (NVD).

The issue has been fixed by adding a kfree() call in the error path. Several Linux distributions have released patches, including Ubuntu which has fixed it in version 5.15.0-69.76~20.04.1 for various kernel packages (Ubuntu).