CVE-2022-50727: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50727 is a memory leak vulnerability in the Linux kernel's SCSI efct driver, specifically within the efct_device_init() function. When efct_scsi_reg_fc_transport() fails during initialization, efct_scsi_tgt_driver_exit() is not called to release memory previously allocated by efct_scsi_tgt_driver_init(), resulting in a kernel memory leak. The vulnerability affects Linux kernel versions starting from commit 4df84e8466242de835416a4ec0c856c0e2ed26eb (introduced in kernel 5.14) up to the respective fix commits across stable branches. It was published on December 24, 2025, with a CVSS estimate of Medium severity and an EPSS score of 0.00018 (Feedly, CVE.org).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the efct_device_init() function of the Linux kernel's efct SCSI driver. When efct_scsi_reg_fc_transport() returns an error, the error-handling path fails to invoke efct_scsi_tgt_driver_exit(), leaving a 2048-byte kernel heap object (allocated via kmalloc_trace through target_register_template in target_core_mod) unreferenced and unfreed. The leak is triggered during module loading (e.g., via modprobe efct) when the FC transport registration step fails, and is observable via kernel memory leak detection tools such as kmemleak (Feedly). Fixes were applied across multiple stable branches with commits 038359ee, 0c6e6bb3, c7e96168, and bb0cd225 (Kernel Git).

The vulnerability causes a kernel memory leak, gradually consuming non-reclaimable kernel heap memory each time the efct module is loaded and the FC transport registration fails. Over repeated occurrences, this can degrade system availability by exhausting kernel memory resources, potentially leading to system instability or denial of service. There is no known impact on confidentiality or integrity, and the vulnerability does not enable privilege escalation or lateral movement (Feedly).

The Linux kernel maintainers have released fixes across multiple stable branches: kernel 5.15.86 (commit bb0cd225), kernel 6.0.16 (commit c7e96168), kernel 6.1.2 (commit 0c6e6bb3), and kernel 6.2 (commit 038359ee). Users should update to a patched kernel version corresponding to their distribution's stable branch. SUSE has also issued advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) addressing this CVE in their kernel packages (Feedly, Linux Security). As a workaround, avoiding loading the efct kernel module in environments where it is not required will prevent exposure to this leak.