CVE-2022-50622: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50622 is a memory leak vulnerability in the Linux kernel's ext4 filesystem subsystem, specifically within the ext4_fc_record_modified_inode() function. The flaw arises when krealloc() returns NULL — in this case, state->fc_modified_inodes is not properly freed, yet the pointer is overwritten with NULL, resulting in a memory leak. It affects Linux kernel versions prior to 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. Disclosed on December 8, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is improper memory management (CWE-401: Missing Release of Memory after Effective Lifetime) in the ext4 fast-commit path. When krealloc() fails and returns NULL inside ext4_fc_record_modified_inode(), the original allocation pointed to by state->fc_modified_inodes is not explicitly freed before the pointer is set to NULL, causing the previously allocated memory to become unreachable and leaked. Exploitation requires low-privilege local access to a system using the ext4 filesystem with fast-commit enabled. No public proof-of-concept exploit code is known to exist (Red Hat CVE, ENISA EUVD).

Successful exploitation causes gradual memory exhaustion on affected Linux systems, potentially leading to system performance degradation, instability, or denial of service over time. The vulnerability has no confidentiality or integrity impact; the sole consequence is availability degradation (CVSS availability impact: High). Because exploitation requires only low-privilege local access, an unprivileged user on a multi-tenant or shared system could leverage this to degrade system resources for other users or services (Red Hat CVE, ENISA EUVD).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term (Red Hat CVE, Feedly).

Patches are available for multiple stable kernel branches. Users should upgrade to Linux kernel version 5.10.150, 5.15.75, 5.19.17, 6.0.3, or 6.1 (or later), which contain the fix for this memory leak. As a short-term workaround where upgrading is not immediately possible, administrators can minimize local user access to critical systems and monitor system memory usage for unexpected increases. Regular kernel update practices are strongly recommended (ENISA EUVD, Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE advisory page. SUSE has also issued kernel security updates addressing this CVE, as reflected in multiple Linux security advisories. No notable researcher commentary or significant social media discussion has been observed for this vulnerability (Red Hat CVE, Linux Security SUSE).