CVE-2022-50578: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50578 is a vulnerability discovered in the Linux kernel related to a possible memory leak in the __class_register() function. The issue was disclosed on October 22, 2025, affecting the Linux kernel's class registration mechanism (NVD).

The vulnerability occurs when class_add_groups() returns an error, where 'cp->subsys' needs to be unregistered and 'cp' needs to be freed. The issue arises because calling kset_unregister() would cause a double free, as 'cls' would be freed both in the callback function class_release() and in the caller's error path. The fix involves using kobject_del() and kfree_const(name) to cleanup the kobject, followed by calling kfree() to free 'cp' (NVD).

The vulnerability can result in memory leaks in the Linux kernel, as demonstrated by fault injection testing which revealed unreferenced objects in memory. This could potentially lead to resource exhaustion over time (NVD).

The vulnerability can be triggered through the modprobe process, as evidenced by the fault injection test results showing memory leaks in the modprobe command context (NVD).

The issue has been resolved in the Linux kernel through a patch that properly handles the cleanup of resources in the error path. The fix includes using kobject_del() instead of kset_unregister() and ensuring proper memory deallocation (NVD).