CVE-2022-50662: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50662 is a memory leak vulnerability in the Linux kernel's RDMA/hns (HiSilicon RoCE) driver, specifically within the hns_roce_alloc_mr() function. When hns_roce_mr_enable() fails during memory region allocation, the mr_key resource is not properly released, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions starting from commit 9b2cf76c9f052987ae5c4ad450ebebdc7c5d7b87 up to the patched releases. It was published on December 9, 2025, with patches backported to stable branches including 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The CVSS score is estimated as Medium (Feedly, ENISA EUVD).

The root cause is a missing resource cleanup path in the RDMA/hns driver's hns_roce_alloc_mr() function (CWE-401: Missing Release of Memory after Effective Lifetime). When the call to hns_roce_mr_enable() returns an error, the code path exits without releasing the previously allocated mr_key, causing a kernel memory leak. This is a local, kernel-space issue requiring the RDMA/hns subsystem to be in use; it is not remotely exploitable. The fix was noted as "compiled test only," indicating the patch was verified by build testing rather than runtime testing (Feedly, ENISA EUVD).

The primary impact is a kernel memory leak in systems using HiSilicon RoCE (RDMA over Converged Ethernet) hardware. Repeated triggering of the failure path in hns_roce_alloc_mr() could gradually exhaust kernel memory resources, potentially leading to degraded system performance or denial of service over time. There is no known impact on confidentiality or integrity, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50662. The EPSS score is extremely low at 0.000180, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with HiSilicon RoCE hardware and the ability to trigger RDMA memory region allocation failures (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches: 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to a patched kernel version corresponding to their distribution's stable branch. SUSE Linux has also issued kernel security updates addressing this CVE (Feedly, ENISA EUVD). No configuration-based workaround is available; upgrading the kernel is the recommended remediation.

SUSE Linux issued security advisories (SUSE-2026:0263-1, SUSE-2026:0317-1, SUSE-2026:0411-1) addressing this CVE as part of broader kernel update bundles. Coverage has been limited to routine vulnerability tracking by VulDB, Vulners, and Tenable (Nessus plugin 278318), with no notable researcher commentary or broader media attention given the low severity and limited exploitability (Feedly).