CVE-2022-50619: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50619 is a memory leak vulnerability in the Linux kernel's drm/amdkfd subsystem, specifically within the kfd_mem_dmamap_userptr() function. When the number of pages from a userptr Buffer Object (BO) differs from the SG BO, allocated memory for the scatter-gather (SG) table is not freed before returning -EINVAL, resulting in a memory leak in certain error paths. The vulnerability affects Linux kernel versions starting from commit 264fb4d332f5e76743818480e482464437837c52 (introduced in 5.14) up to the fixes applied in stable releases. It was published on December 8, 2025, with an EPSS score of 0.024% (Low) and no CVSS base score has been assigned (EUVD).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the kfd_mem_dmamap_userptr() function of the AMD KFD (Kernel Fusion Driver) within the Linux DRM subsystem. When an error condition is encountered — specifically a page count mismatch between the userptr BO and the SG BO — the function returns -EINVAL without first freeing the memory allocated for the SG table, leaving it unreachable and leaked. The fix involves reordering the page count validation check to occur before the SG table memory allocation, preventing the allocation from occurring in the error path entirely. Patches were applied to stable branches at commits 304a10161696, c6dc4c9ba093, and 90bfee142af0 (EUVD, Kernel Patch 1, Kernel Patch 2).

Successful triggering of this vulnerability results in kernel memory being leaked over time, degrading system availability through gradual memory exhaustion. The impact is limited to availability — there is no direct confidentiality or integrity compromise — but repeated triggering in environments using AMD GPU hardware with userptr memory mappings could lead to system instability or denial of service. The vulnerability is confined to systems running AMD GPU drivers with the KFD subsystem enabled (EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50619. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with AMD GPU hardware and the ability to trigger the specific error path in kfd_mem_dmamap_userptr() (EUVD).

The vulnerability is fixed in Linux kernel stable releases 5.15.77, 6.0.7, and 6.1 and later. Users should update their Linux kernel to one of these patched versions or any subsequent stable release. The specific fixes are available at kernel.org stable commits 304a10161696, c6dc4c9ba093829ebe1450d5fb101da6fb7a2a58, and 90bfee142af0f0e9d3bec80e7acd5f49b230acf7. SUSE Linux has also issued kernel security updates addressing this CVE (EUVD, SUSE Advisory).