CVE-2022-50637: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50637 is a memory leak vulnerability in the Linux kernel's Qualcomm CPU frequency scaling driver (cpufreq: qcom-hw). Specifically, in the qcom_cpufreq_hw_read_lut() function, if cpu_dev fails to obtain the OPP (Operating Performance Points) table, the function returns early without releasing the previously allocated table resource, resulting in a kernel memory leak. The vulnerability was published on December 9, 2025, and affects Linux kernel versions starting from 5.9 (introduced at commit 51c843cf77bb). Fixed versions include kernel 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The CVSS base score is not formally assigned (estimated Medium severity by Feedly) (Feedly, ENISA EUVD).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the qcom_cpufreq_hw_read_lut() function within the Linux kernel's drivers/cpufreq/qcom-cpufreq-hw.c. When the function calls dev_pm_opp_get_opp_table(cpu_dev) and that call fails, the error-handling path returns immediately without freeing the table buffer that was allocated earlier in the function. This is a local, kernel-space issue requiring the specific error condition (OPP table retrieval failure) to be triggered, which limits its practical exploitability. The fix ensures proper cleanup of the table resource in all error paths (Feedly, ENISA EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems running Qualcomm hardware with the qcom-cpufreq-hw driver. Over time, this could degrade system performance or contribute to denial-of-service conditions if the leak is triggered repeatedly. There is no known impact on confidentiality or integrity, and the vulnerability does not enable code execution or privilege escalation (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50637. The EPSS score is extremely low at 0.000180 (approximately 0.018%), reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable via Nessus plugin 278040 (Feedly, Tenable).

The vulnerability is fixed in Linux kernel stable releases: 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Administrators should update to these or later kernel versions. The fix ensures that the table resource is properly freed in all error paths within qcom_cpufreq_hw_read_lut(). Downstream distributions (SUSE, Red Hat, etc.) are expected to backport the fix into their respective kernel packages (ENISA EUVD, Vulners SUSE).