CVE-2022-50639: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50639 is a memory leak vulnerability in the Linux kernel's io-wq (io_uring work queue) subsystem, specifically in the worker creation path. When CPU mask allocation for a NUMA node fails during io_wq_create(), the memory allocated for the io_wqe struct of the current node is not freed on the error handling path because it has not yet been added to the wqes array. The vulnerability affects Linux kernel versions from 5.14 up to (but not including) the patched releases in the 5.15.x and 6.0.x stable series. It was discovered via Syzkaller fuzzing of v6.1-rc1 and publicly disclosed on December 9, 2025. The CVSS base score is not formally assigned (estimated Medium severity by Feedly; EPSS score: 0.000170) (Feedly, EUVD).

The root cause is a missing kfree() call on the error handling path in io_wq_create() (CWE-401: Missing Release of Memory after Effective Lifetime). When alloc_cpumask_var_node() fails for a given NUMA node, the previously allocated io_wqe struct for that node has not yet been inserted into the wqes array, so the subsequent cleanup loop that iterates over wqes does not reach it and the memory is leaked. The bug is triggered via the io_uring_setup syscall, specifically through the call chain: io_uring_setup → io_uring_alloc_task_context → io_wq_create. The fix involves freeing the partially-initialized io_wqe struct before returning on the error path (Feedly, Kernel Git).

Successful triggering of this vulnerability results in a kernel memory leak, gradually exhausting kernel memory resources over time. The primary availability impact is potential system instability or denial of service if the leak is triggered repeatedly, as kernel memory is a finite and critical resource. There is no direct confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution on its own (Feedly).

No public exploit code or weaponized proof-of-concept is known for this vulnerability. The bug was discovered through automated fuzzing (Syzkaller) rather than targeted exploitation, and there is no evidence of in-the-wild exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000170, reflecting minimal exploitation probability (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include Linux 5.15.75, 6.0.4, and 6.1 (mainline). The relevant upstream commits are b6e2c54be37d5eb4f6666e6aa59cd0581c7ffc3c (5.15.x), ed981911a7c90a604f4a2bee908ab07e3b786aca (6.0.x), and 996d3efeb091c503afd3ee6b5e20eabf446fd955 (6.1). Users should update to a patched kernel version; Amazon Linux 2 users can refer to ALAS2KERNEL-5.15-2025-090. No configuration-based workaround is available beyond disabling io_uring if operationally feasible (Kernel Git, Amazon ALAS).