CVE-2022-50631: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50631 is a memory leak vulnerability in the Linux kernel's RISC-V kexec implementation, specifically in the elf_kexec_load() function. When a kexec kernel is reloaded or unloaded on RISC-V systems, a buffer allocated via kvmalloc() to store the Flattened Device Tree (FDT) is never freed, causing a kernel memory leak. The vulnerability was reported by the kmemleak detector and disclosed on December 8, 2025. Affected versions span from the introduction of the vulnerable code (commit 6261586e0c91) through Linux kernel 6.0.17, 6.1.3, and pre-6.2 releases. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, NVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the RISC-V-specific kexec ELF loader. In elf_kexec_load(), of_kexec_alloc_and_setup_fdt() allocates a kernel buffer via kvmalloc_node() to hold the FDT, but no corresponding kvfree() is called when the kexec image is subsequently reloaded or unloaded via sys_kexec_file_load. The fix introduces a RISC-V-specific arch_kimage_file_post_load_cleanup() function that properly frees the FDT buffer after use. Exploitation of this issue requires local access and the ability to invoke the kexec_file_load syscall, limiting the attack surface to privileged local users (NVD, Feedly).

The primary impact is a kernel memory leak on RISC-V systems using the kexec facility: each reload or unload of a kexec kernel image leaks approximately 9,588 bytes of kernel memory (as observed in the kmemleak report). Repeated invocations could gradually exhaust kernel memory, potentially degrading system availability or causing instability over time. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation (NVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50631. The vulnerability requires local access with sufficient privileges to invoke the kexec_file_load syscall, significantly limiting its exploitability. The EPSS score is 0.000170 (approximately 0.017%), indicating a very low probability of exploitation in the near term. CVE-2022-50631 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The fix is available in Linux kernel stable releases 6.0.18, 6.1.4, and 6.2, where the RISC-V-specific arch_kimage_file_post_load_cleanup() function is introduced to properly free the FDT buffer. Administrators running RISC-V Linux systems should update to a patched kernel version. As a workaround, avoiding repeated kexec kernel reloads/unloads on affected systems can reduce the memory leak impact until a patch is applied (NVD, Kernel Patch 6.0, Kernel Patch 6.1, Kernel Patch main).