CVE-2022-50578: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50578 is a vulnerability discovered in the Linux kernel related to a possible memory leak in the _classregister() function. The issue was disclosed on October 22, 2025, affecting the Linux kernel's class registration mechanism (NVD).

The vulnerability occurs when classaddgroups() returns an error, where 'cp->subsys' needs to be unregistered and 'cp' needs to be freed. The issue arises because calling ksetunregister() would cause a double free, as 'cls' would be freed both in the callback function classrelease() and in the caller's error path. The fix involves using kobjectdel() and kfreeconst(name) to cleanup the kobject, followed by calling kfree() to free 'cp' (NVD).

The vulnerability can result in memory leaks in the Linux kernel, as demonstrated by fault injection testing which revealed unreferenced objects in memory. This could potentially lead to resource exhaustion over time (NVD).

The issue has been resolved in the Linux kernel through a patch that properly handles the cleanup of resources in the error path. The fix includes using kobjectdel() instead of ksetunregister() and ensuring proper memory deallocation (NVD).