CVE-2022-50660: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50660 is a memory leak vulnerability in the Linux kernel's ipw2200 Wi-Fi driver, specifically within the ipw_wdev_init() function. When an error occurs in the initialization path, allocated memory is not properly released — neither in ipw_wdev_init() nor in the calling function ipw_pci_probe() — resulting in a kernel memory leak. The vulnerability was published on December 9, 2025, and affects Linux kernel versions from 2.6.33 up to the patched stable releases. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.024% (Feedly, EUVD).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the error path of ipw_wdev_init(), the function returns an exception value without freeing the memory it allocated; additionally, the caller ipw_pci_probe() does not perform cleanup either. This is a local, kernel-space issue triggered during device initialization — exploitation would require the ability to load or interact with the ipw2200 driver on a system with compatible Intel PRO/Wireless 2200 hardware. The fix involves adding proper memory release calls to the error path of ipw_wdev_init() (Feedly, Kernel Git).

The primary impact is an availability concern: repeated triggering of the error path in ipw_wdev_init() can cause kernel memory to be gradually exhausted, potentially degrading system performance or contributing to system instability over time. There is no direct confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation. The affected scope is limited to systems running the ipw2200 driver with Intel PRO/Wireless 2200 series hardware (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50660. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is inherently limited by the requirement for specific legacy Intel wireless hardware and local system access (Feedly).

The Linux kernel stable trees have been patched across multiple supported branches. Fixed versions include kernel 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Users should update to the appropriate patched kernel version for their distribution. SUSE Linux has also issued advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) incorporating this fix. As a workaround, systems that do not use Intel PRO/Wireless 2200 hardware can blacklist the ipw2200 kernel module to prevent the vulnerable code from loading (Feedly, Linux Security).