CVE-2022-50750: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50750 is a memory leak vulnerability in the Linux kernel's drm/panel/panel-sitronix-st7701 driver. When mipi_dsi_attach() fails, the driver does not call drm_panel_remove(), resulting in a memory leak that can lead to resource exhaustion. The vulnerability affects Linux kernel versions from 5.1 up to patch versions 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. It was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the panel-sitronix-st7701 DRM panel driver. When the MIPI DSI attach operation (mipi_dsi_attach()) fails during driver initialization, the code path does not invoke drm_panel_remove(), leaving the panel object registered and its associated memory unreleased. Exploitation requires local access with low privileges to trigger the DSI attach failure condition. The fix, backported across multiple stable kernel branches, adds the missing drm_panel_remove() call in the error handling path (Red Hat Bugzilla).

Successful exploitation of this vulnerability can cause memory resource exhaustion on affected systems, leading to degraded system performance or denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability is locally scoped and does not enable lateral movement or data exfiltration, but repeated triggering could destabilize systems relying on the affected DRM panel driver (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-50750. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, further limiting its practical attack surface (Feedly).

Update the Linux kernel to a patched version: 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2 (mainline). Patches have been applied to multiple stable kernel branches via commits to the kernel stable tree. Distributions such as SUSE have also released vendor-specific kernel updates addressing this CVE. Administrators should apply the relevant kernel update for their distribution and monitor system memory usage for anomalies if immediate patching is not possible (Red Hat Bugzilla, Linux Security SUSE).