CVE-2022-50748: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50748 is a memory leak vulnerability in the Linux kernel's IPC message queue subsystem (ipc/mqueue). Specifically, the init_mqueue_fs() function fails to call retire_mq_sysctls() when initialization fails after setup_mq_sysctls() has already been called, resulting in a resource leak. The affected versions span Linux kernel commits from dc55e35f9e810f23dd69cfdc91a3d636023f57a2 up to the respective fix commits across stable branches, with patches available for kernel versions 5.19.17, 6.0.3, and 6.1. The vulnerability was published on December 24, 2025, and is estimated as Medium severity with a CVSS base score of 0.0 per ENISA/EUVD data (Feedly).

The root cause is a missing cleanup call in the error-handling path of init_mqueue_fs() in the Linux kernel's IPC mqueue subsystem (CWE-401: Missing Release of Memory after Effective Lifetime). When init_mqueue_fs() encounters a failure after setup_mq_sysctls() has successfully allocated sysctl resources, it does not invoke retire_mq_sysctls() to free those resources, mirroring a similar bug previously fixed by commit db7cfc380900 ("ipc: Free mq_sysctls if ipc namespace creation failed"). Exploitation would require triggering the failure path in init_mqueue_fs(), which is a kernel initialization function, making this primarily a local or kernel-internal issue rather than a remotely exploitable attack surface (Feedly). Patches were applied to three stable kernel branches via commits a1f321051e0d, 55b3709c6d68, and c579d60f0d0c (Kernel Git).

The primary impact of this vulnerability is a kernel memory leak, where sysctl resources allocated during message queue filesystem initialization are not freed upon failure. This can lead to gradual memory exhaustion in affected kernel configurations, potentially degrading system availability over time. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution based on available information (Feedly).

Apply the upstream Linux kernel patches that introduce the missing retire_mq_sysctls() call in the error path of init_mqueue_fs(). Fixed versions include kernel 5.19.17 (commit c579d60f0d0c), 6.0.3 (commit 55b3709c6d68), and 6.1 (commit a1f321051e0d) (Kernel Git). Linux distribution maintainers (e.g., Red Hat, Ubuntu, SUSE) should be consulted for distribution-specific backported patches. No configuration-based workaround is known; upgrading to a patched kernel version is the recommended remediation.