CVE-2022-50734: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50734 is a memory leak (memleak) vulnerability in the Linux kernel's NVMEM (Non-Volatile Memory) subsystem, specifically within the nvmem_register() function. The flaw was disclosed on December 24, 2025, and affects Linux kernel versions starting from the introduction of the vulnerable code (commit de0534df93474f268486c486ea7e01b44a478026) up to the respective fix commits across stable branches. Fixed versions include kernel 5.15.75, 5.19.17, 6.0.3, and 6.1. The CVSS base score is listed as 0.0 (no official severity rating assigned), with Feedly estimating it as Medium severity (Feedly, ENISA EUVD).

The root cause is a memory management error (CWE-401: Missing Release of Memory after Effective Lifetime) in the nvmem_register() function of the Linux kernel's NVMEM core subsystem. When dev_set_name() allocates memory for nvmem->dev.kobj.name, and a subsequent call to nvmem_validate_keepouts() fails, the function frees the nvmem structure and returns an error — but the memory allocated for the kobject name is never released, resulting in a kernel memory leak. The fix reorders the logic by moving nvmem_validate_keepouts() to execute after device_register(), allowing the device core's cleanup path to properly handle deallocation of the kobject name on error (Feedly, ENISA EUVD).

The vulnerability causes a kernel memory leak each time nvmem_register() is called and nvmem_validate_keepouts() fails, gradually consuming kernel memory over time. This primarily affects availability — repeated triggering of the error path could contribute to kernel memory exhaustion, potentially degrading system stability or performance. There is no direct confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution on its own (Feedly).

CVE-2022-50734 has an EPSS score of approximately 0.018% (0.000180), indicating a very low probability of exploitation in the wild. There is no known public proof-of-concept exploit, no evidence of in-the-wild exploitation, no threat actor attribution, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires local access and specific error conditions in the NVMEM subsystem to trigger (Feedly).

The Linux kernel maintainers have addressed this vulnerability in the following stable releases: 5.15.75, 5.19.17, 6.0.3, and 6.1. The fix involves moving nvmem_validate_keepouts() after device_register() so that the device core properly handles kobject name memory cleanup on error. Users should update their Linux kernel to one of the patched versions. No configuration-based workaround is available; upgrading is the recommended remediation (ENISA EUVD, Kernel Git).