CVE-2022-50733: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50733 is a use-of-uninitialized-value vulnerability in the Linux kernel's USB idmouse driver, specifically within the idmouse_open function. The flaw was discovered via KMSAN (Kernel Memory Sanitizer) and formally published on December 24, 2025. It affects the Linux kernel from its earliest versions up to the patched stable releases across multiple long-term support branches. The CVSS base score is estimated as Medium by Feedly, with an EPSS score of approximately 0.033% (Feedly, EUVD).

The root cause is an uninitialized memory read (CWE-457) in the idmouse_create_image function of the drivers/usb/misc/idmouse.c driver. When any ftip_command call fails during image acquisition, execution jumps to the reset label, leaving the bulk_in_buffer[HEADER..IMGSIZE] region uninitialized. A subsequent validity check on the image data then reads from this uninitialized memory region, constituting an uninit-value dereference as detected by KMSAN. The fix relocates the image validity check to before the reset label, ensuring it is only evaluated when the buffer contains concrete data (Feedly, EUVD).

Exploitation of this vulnerability could result in kernel information disclosure through uninitialized memory reads, potentially leaking sensitive kernel memory contents to a local user or process interacting with the idmouse USB device. The vulnerability is confined to the USB idmouse driver subsystem and requires physical or logical access to a system with the affected driver loaded. There is no known path to remote code execution or privilege escalation directly from this flaw, limiting its practical impact primarily to confidentiality (Feedly).

Patches have been backported to multiple Linux stable kernel branches. Fixed versions include: 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (EUVD). Users should update to the patched kernel version applicable to their distribution. SUSE has issued advisories (e.g., SUSE-2026:0263-1, SUSE-2026:0317-1, SUSE-2026:0350-1, SUSE-2026:0411-1) incorporating these fixes (Linux Security). As a workaround where patching is not immediately possible, blacklisting the idmouse kernel module (modprobe -r idmouse) will prevent the vulnerable code path from being loaded.