CVE-2022-50711: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50711 is a memory leak vulnerability in the Linux kernel's MediaTek Ethernet (mtk_eth_soc) driver. Specifically, in the mtk_probe() function, if mtk_wed_add_hw() is called but a subsequent error occurs or the module is removed, mtk_wed_exit() is not invoked to free the memory allocated by mtk_wed_add_hw(), resulting in a resource leak. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit 804775dfc288 up to the patched commits in the 6.0.x and 6.1 stable branches. No CVSS score has been formally assigned by NVD; Feedly estimates the severity as Medium (Feedly, NVD).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the mtk_probe() function within drivers/net/ethernet/mediatek/mtk_eth_soc.c. When mtk_wed_add_hw() is called to initialize Wireless Ethernet Dispatch (WED) hardware support, it allocates memory that must be freed by a corresponding mtk_wed_exit() call. However, the original code omits this cleanup call in both the error handling path and during module removal, causing the allocated memory to be permanently leaked. Exploitation of this issue is limited to local kernel contexts and does not provide a direct path to privilege escalation or code execution (NVD, kernel.org patch 1, kernel.org patch 2).

The primary impact of this vulnerability is a kernel memory leak, which can gradually degrade system stability and availability on affected devices using the MediaTek Ethernet SoC driver with WED support. Over time, repeated module load/unload cycles or probe failures could exhaust kernel memory resources, potentially leading to system instability or denial of service. There is no known impact on confidentiality or integrity, and no lateral movement or data exfiltration risk has been identified (NVD).

There is no known public exploit code, proof-of-concept, or evidence of in-the-wild exploitation for CVE-2022-50711. The vulnerability is a low-severity memory management issue with an EPSS score of approximately 0.018% (0.000180), indicating a very low probability of exploitation (Feedly). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

The fix has been applied in two stable kernel commits: 96bde7c4f568 (targeting the 6.1 stable branch) and b3d0d98179d6 (targeting the 6.0.6 stable branch). Users running affected Linux kernel versions on MediaTek-based hardware should update to a patched kernel version (6.0.6+ or 6.1+). No configuration-based workaround is available; the recommended remediation is to apply the upstream kernel patches or upgrade to a distribution kernel that includes these fixes (kernel.org patch 1, kernel.org patch 2).