CVE-2022-50646: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50646 is a memory leak vulnerability in the Linux kernel's SCSI HPSA (HP Smart Array) driver, specifically in the hpsa_init_one() function. When alloc_percpu() fails during initialization, the error-handling path jumps to clean1, which frees the controller info structure h directly but fails to release the h->reply_map field allocated by hpda_alloc_ctlr_info(). The vulnerability affects Linux kernel versions from commit 8b834bff1b73 onward, with fixes backported to stable branches including 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. It was publicly disclosed on December 9, 2025, and carries a Medium severity estimate with an EPSS score of 0.024% (Red Hat CVE, Feedly).

The root cause is a missing resource cleanup in an error-handling code path, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In hpsa_init_one(), when alloc_percpu() fails, the function jumps to the clean1 label, which calls kfree(h) directly rather than the proper cleanup function hpda_free_ctlr_info(). This leaves h->reply_map (a per-CPU data structure) unreleased, resulting in a kernel memory leak. The fix replaces the direct kfree(h) call with hpda_free_ctlr_info(h) to ensure both h->reply_map and h are properly freed (Red Hat CVE, ENISA EUVD).

The primary impact is a kernel memory leak in systems using HP Smart Array SCSI controllers, which can gradually exhaust kernel memory resources over time, potentially leading to system instability or denial of service under sustained error conditions. The vulnerability is triggered only when alloc_percpu() fails during driver initialization — an uncommon but possible scenario under memory pressure. There is no known path to privilege escalation, code execution, or data exfiltration from this vulnerability; the impact is limited to availability (Red Hat CVE).

There is no known public exploit code, proof-of-concept, or evidence of in-the-wild exploitation for CVE-2022-50646. The vulnerability requires a specific failure condition (alloc_percpu() returning an error) during driver initialization, making it difficult to trigger reliably. The EPSS score is 0.024%, reflecting very low exploitation probability, and it is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Users should update to the following patched versions or later: 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2. Distribution-specific kernel updates from vendors such as Red Hat and SUSE also include this fix. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Red Hat CVE, ENISA EUVD).