CVE-2022-50743: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50743 is a memory leak (memleak) vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) compressed file system driver. The flaw exists in the z_erofs_register_pcluster() function, where a pcluster object is leaked when its block address (map->m_pa) is zero and ztailpacking is false. This causes the pcluster's obj.index to be set to zero, making it indistinguishable from an inline pcluster, leading to a reference count imbalance and kernel memory leak. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from 5.17 up to the patched releases (6.1.2, 6.0.16, and 6.2). It carries an estimated CVSS severity of Medium and an EPSS score of 0.017% (Feedly, EUVD).

The root cause is a missing validation check in z_erofs_register_pcluster() within the Linux kernel's EROFS subsystem (CWE-401: Missing Release of Memory after Effective Lifetime). When ztailpacking is false and map->m_pa equals zero, the pcluster's obj.index is set to zero, which is the same value used to identify inline pclusters. Subsequent calls to z_erofs_readahead() → z_erofs_do_read_page() → z_erofs_collector_begin() → erofs_find_workgroup() → erofs_workgroup_get() increment the reference count for the workgroup (grp), but the reference is never released because the code incorrectly treats the pcluster as inline. The fix adds a validity check to reject registration of non-inline pclusters with a zero block address, preventing the leak. The issue was originally identified by the syzkaller fuzzer (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems over time. This affects system availability, as sustained memory exhaustion may lead to degraded performance or system instability. There is no direct confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation based on currently available information (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 6.1.2, 6.0.16, and 6.2. The fix is applied via commits ac54c1f7b288d83b6ba1e320efff24ecc21309cd (6.1.x), 618e712b99c78d1004b70a1a9ab0a4830d0b2673 (6.0.x), and c42c0ffe81176940bd5dead474216b7198d77675 (mainline). Administrators running Linux kernel versions 5.17 through the affected range should update to a patched kernel version. No configuration-based workaround is available; upgrading is the recommended remediation (EUVD, Kernel Patch 6.1.x).