CVE-2022-50669: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50669 is a memory/resource leak vulnerability in the Linux kernel's misc/ocxl subsystem, specifically in the ocxl_file_register_afu() function. When device_register() returns an error, the device name allocated by dev_set_name() is not properly freed, resulting in a memory leak. The vulnerability affects Linux kernel versions starting from commit 75ca758adbafc81804c39b2c200ecdc819a6c042 (introduced in kernel 5.2) up to the patched stable releases. It was published on December 9, 2025, and carries an estimated CVSS severity of Medium (Feedly, EUVD).

The root cause is a missing error-path cleanup in ocxl_file_register_afu() within the Linux kernel's OpenCAPI Accelerator Function Unit (OCXL) driver (CWE-401: Missing Release of Memory after Effective Lifetime). When device_register() fails, the code does not call put_device() to release the reference, which would normally trigger kobject_cleanup() to free the name string and info_release() to free the associated info structure. The fix involves replacing the direct error return with a call to put_device() in the error path, allowing the kernel's reference-counting infrastructure to handle cleanup correctly (Feedly, Kernel Patch).

The primary impact of this vulnerability is a kernel memory leak in systems using the OCXL (OpenCAPI Accelerator) driver, which is specific to IBM POWER9/POWER10 hardware with OpenCAPI-attached accelerators. Repeated triggering of the error path could gradually exhaust kernel memory resources, potentially leading to degraded system performance or denial of service over time. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

CVE-2022-50669 has a very low EPSS score of 0.024% and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The vulnerability is limited to systems with specific IBM OpenCAPI hardware and requires the ability to trigger error conditions in the OCXL driver, making practical exploitation highly unlikely (Feedly).

The Linux kernel stable team has released patches across multiple stable branches. Fixed versions include: 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2 (mainline). Administrators running affected kernel versions on IBM OpenCAPI-capable hardware should update to the appropriate patched stable release. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, EUVD).

Coverage of CVE-2022-50669 has been limited to routine security advisory aggregators, including SUSE kernel update advisories and Tenable plugin updates. No notable researcher commentary or significant community discussion has been observed, consistent with the low severity and narrow hardware scope of the vulnerability (LinuxSecurity, Tenable).