CVE-2022-50643: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50643 is a resource leak vulnerability in the Linux kernel's CIFS (Common Internet File System) subsystem, specifically in the cifs_copy_file_range() function. When a file is used by swap and the function returns -EOPNOTSUPP, it fails to free the transaction ID (xid) before returning, resulting in an xid leak. The vulnerability affects Linux kernel versions from 5.7 up to the patched stable releases (5.10.152, 5.15.76, 6.0.6, and 6.1). It was published on December 9, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000180 (Feedly, ENISA EUVD).

The root cause is a missing resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the cifs_copy_file_range() function within the Linux kernel's CIFS driver. When the function detects that the target file is used by swap and returns the error code -EOPNOTSUPP, it exits without calling the appropriate xid release routine, causing the xid (a transaction identifier used internally by the CIFS subsystem) to be permanently leaked. The fix involves adding the xid free call on the early-exit swap-file code path before returning the error. Patches were applied to multiple stable kernel branches, with commits including bf49d4fe, 27cfd3af, dc283313, and 9a97df40 (Feedly, ENISA EUVD).

The primary impact of this vulnerability is an availability concern: repeated triggering of the xid leak in cifs_copy_file_range() could exhaust the pool of available transaction IDs in the CIFS subsystem, potentially causing CIFS operations to fail or the system to become unstable over time. There is no direct confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation. The scope is limited to systems running Linux kernels with the CIFS module active and performing file range copy operations on swap-backed files (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50643. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at 0.000180, reflecting a very low probability of exploitation in the near term. Detection coverage exists via Nessus plugin 278043 and Qualys detection ID 760644 (Feedly, Tenable).

The vulnerability is fixed in the following Linux stable kernel versions: 5.10.152, 5.15.76, 6.0.6, and 6.1. Users should update their Linux kernel to one of these patched versions or any later release. Distributions such as SUSE have issued kernel security advisories (e.g., SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0411) incorporating these fixes. As a temporary workaround, avoiding CIFS file range copy operations on swap-backed files may reduce exposure, though upgrading the kernel is the recommended remediation (Feedly, Linux Security SUSE Advisory).