CVE-2022-50738: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50738 is a memory leak vulnerability in the Linux kernel's vhost-vdpa subsystem, specifically in the IOTLB (I/O Translation Lookaside Buffer) handling code. The flaw was introduced when commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") inadvertently removed cleanup code that freed resources allocated during IOTLB message processing. A partial fix via commit 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") did not fully resolve the issue. The vulnerability affects the Linux kernel and was published on December 24, 2025, with a CVSS category estimate of Medium and an EPSS score of 0.017% (Feedly).

The root cause is a resource management error (CWE-401: Missing Release of Memory after Effective Lifetime) in the vhost-vdpa kernel module. When a userspace application sends IOTLB update messages via vhost_vdpa_process_iotlb_update(), kernel memory is allocated via kmem_cache_alloc_trace. If the application exits without sending a VHOST_IOTLB_INVALIDATE message or crashes, the release path fails to call vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1), leaving allocated IOTLB entries unreferenced and leaking memory. The kmemleak tool confirms the leak, showing unreferenced objects originating from vhost_vdpa_process_iotlb_msg (Feedly). Fixes are available in the stable kernel tree via commits 4e92cb33bfb5, a2907867e2c8, and c070c1912a83 (kernel.org).

Successful triggering of this vulnerability results in a kernel memory leak, gradually exhausting available memory on affected systems over time. The primary impact is on availability — systems running workloads that use vhost-vdpa (e.g., virtual machine I/O with virtio devices) may experience degraded performance or eventual out-of-memory conditions if the leak is sustained. There is no direct confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation (Feedly).

The fix is available in the Linux kernel stable tree via commits 4e92cb33bfb5, a2907867e2c8, and c070c1912a83, which restore the proper IOTLB cleanup call during the vhost-vdpa device release path. Administrators should update to a patched kernel version that includes these fixes. SUSE has issued advisories addressing this CVE (SUSE-2026:0263-1 and SUSE-2026:0317-1), and Tenable has published a Nessus plugin (ID 279876) for detection (Feedly, Tenable). As a workaround, limiting access to vhost-vdpa devices to trusted applications reduces exposure.