CVE-2022-50723: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50723 is a memory leak vulnerability in the Linux kernel's bnxt_en network driver, specifically within the bnxt_nvm_test() function. The flaw occurs because a kzalloc-allocated buffer is not freed before returning in the success path, resulting in a kernel memory leak. It was published on December 24, 2025, and affects Linux kernel versions in the range from commit 5b6ff128fdf6 up to the patched commits. Fixed versions include Linux 6.0.6 and 6.1. The CVSS base score is not formally assigned (estimated Medium by Feedly; ENISA lists a base score of 0.0 pending full analysis) (Feedly, ENISA EUVD).

The root cause is a missing kfree() call in the success return path of bnxt_nvm_test() in the Linux kernel's Broadcom bnxt_en Ethernet driver, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When the NVM (Non-Volatile Memory) test completes successfully, the function returns without freeing the buffer previously allocated with kzalloc, causing a kernel memory leak. Exploitation requires local access to trigger the NVM test path, typically through privileged network driver diagnostics or ethtool operations. Patches are available as stable kernel commits be083d97031712a2e16fd915ddb8fe1a6cb1fbc5 (6.1 branch) and ba077d683d45190afc993c1ce45bcdbfda741a40 (6.0.x branch) (Feedly, ENISA EUVD).

The primary impact is a kernel memory leak, which over time can degrade system availability by exhausting kernel memory resources, potentially leading to system instability or denial of service on affected hosts. Confidentiality and integrity are not directly impacted, as the vulnerability does not expose memory contents to unprivileged users or allow arbitrary code execution. The affected scope is limited to systems running the Broadcom bnxt_en driver with vulnerable kernel versions (Feedly).

Apply the upstream Linux kernel patches: commit be083d97031712a2e16fd915ddb8fe1a6cb1fbc5 for the 6.1 branch and ba077d683d45190afc993c1ce45bcdbfda741a40 for the 6.0.x branch, both of which add the missing kfree() call in bnxt_nvm_test(). Distributions such as SUSE have issued kernel updates addressing this CVE (e.g., SUSE advisories SUSE-2026:0263-1 and SUSE-2026:0317-1). Users should update to Linux kernel 6.0.6 or 6.1 (or later), or apply the relevant distribution-provided kernel update (ENISA EUVD, Linux Security SUSE).