CVE-2022-50707: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50707 is a memory leak vulnerability in the Linux kernel's virtio-crypto subsystem, specifically within the virtio_crypto_alg_skcipher_close_session() function. The flaw occurs because the vc_ctrl_req allocation is not freed in the error handling path when ctrl_status->status is invalid, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions from commit 0756ad15b1fe up to the fixes applied in stable releases 6.0.19 and 6.1.5, as well as the 6.2 mainline release. It was published on December 24, 2025, and no CVSS score has been assigned by NVD at this time (Feedly, ENISA EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the error handling branch of virtio_crypto_alg_skcipher_close_session() in the Linux kernel's virtio-crypto driver. When the function allocates vc_ctrl_req and subsequently encounters an error condition where ctrl_status->status is invalid, the code path exits without calling the appropriate free routine, leaking kernel memory. Exploitation would require the ability to trigger symmetric cipher session close operations through the virtio-crypto interface, typically available to guest virtual machines using a virtio-crypto device. Fixes were applied across multiple stable branches, with patch commits available at the kernel.org stable tree (Feedly, kernel.org patch 6.1.5).

The primary impact of this vulnerability is a kernel memory leak, which can degrade system availability over time by exhausting kernel memory resources if the vulnerable code path is triggered repeatedly. In virtualized environments using virtio-crypto, a guest VM could potentially trigger repeated session close errors to cause memory exhaustion on the host kernel, leading to denial-of-service conditions. There is no known direct path to privilege escalation, code execution, or data confidentiality breach from this vulnerability alone (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50707. The EPSS score is extremely low at 0.000180 (approximately 0.018%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 280043 (Feedly, Tenable).

The fix has been applied to the Linux kernel stable branches. Affected systems should be updated to kernel version 6.0.19 or later in the 6.0.x series, 6.1.5 or later in the 6.1.x series, or 6.2 in the mainline. The specific patch commits are available at the kernel.org stable tree for each affected branch. No configuration-based workaround is available; upgrading the kernel is the recommended remediation. Systems not using virtio-crypto devices are not exposed to this code path (Feedly, ENISA EUVD).