CVE-2022-50633: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50633 is a memory leak vulnerability in the Linux kernel's USB DWC3 QCOM driver, specifically in the dwc3_qcom_interconnect_init function. The flaw occurs because of_icc_get() allocates resources for a path handle that are not properly released on error paths, leading to a kernel memory leak. It affects Linux kernel versions starting from commit bea46b9815154ac47baf16b64022d791a4471375 up to the respective fixes in stable branches. The vulnerability was published on December 9, 2025, and is estimated as Medium severity with an EPSS score of 0.00018 (Feedly, Vulners/SUSE).

The root cause is a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime) in the error handling path of dwc3_qcom_interconnect_init() in drivers/usb/dwc3/dwc3-qcom.c. When of_icc_get() successfully allocates an interconnect path handle but a subsequent initialization step fails, the allocated handle is not freed via icc_put(), unlike the cleanup performed in the corresponding dwc3_qcom_interconnect_exit() function. The fix adds icc_put() calls in the error handling path to mirror the teardown logic. Patches were applied across multiple stable branches: 5.10.163, 5.15.87, 6.0.17, 6.1.2, and 6.2 (Kernel Git, Kernel Git).

The vulnerability results in a kernel memory leak on systems using Qualcomm-based USB DWC3 hardware with interconnect support. Repeated triggering of the affected code path (e.g., through USB device attach/detach cycles or driver re-initialization) could gradually exhaust kernel memory, potentially degrading system stability or availability. There is no known impact on confidentiality or integrity, and the vulnerability does not enable privilege escalation or remote code execution.

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50633. The EPSS score is extremely low at 0.00018, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable via Nessus plugin 278090 (Tenable).

Apply the upstream Linux kernel patches that add icc_put() to the error handling path in dwc3_qcom_interconnect_init(). Fixed versions include stable releases 5.10.163, 5.15.87, 6.0.17, 6.1.2, and 6.2. SUSE has also issued kernel security updates addressing this CVE (Vulners/SUSE, Linux Security). Users on affected distributions should apply vendor-provided kernel updates as soon as available.