CVE-2022-50751: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50751 is a memory leak vulnerability in the Linux kernel's configfs subsystem, specifically within the configfs_create_dir() function, caused by incorrect reference counting. When configfs_create() fails during directory creation, the reference count for the sd (configfs dirent) and associated fragment objects is not properly decremented, resulting in kernel memory leaks. This can lead to a Denial of Service condition. The vulnerability affects the Linux kernel and was publicly disclosed on December 24, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper reference counting (CWE-401: Missing Release of Memory after Effective Lifetime) in configfs_make_dirent() within fs/configfs/dir.c. During normal operation, configfs_new_dirent() sets the reference count (s_count) to 1, and dentry->d_fsdata = configfs_get(sd) increments it to 2; cleanup via configfs_d_iput() eventually decrements it to 0 and frees memory. However, in the error path where configfs_create() fails, the inode is never created, so configfs_d_iput() is never called, leaving s_count at 1 and leaking both the sd object (192 bytes) and the dirent object (96 bytes). The fix involves manually calling configfs_put(sd) in the error path to maintain correct reference counts. Exploitation requires local access and low privileges to trigger the error path, for example by loading a kernel module that registers a configfs subsystem (Red Hat Bugzilla).

Successful exploitation results in kernel memory leaks each time the vulnerable error path is triggered, gradually exhausting available kernel memory and potentially causing a Denial of Service (system instability or crash). There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The scope is confined to the local system, with no known potential for lateral movement or privilege escalation (Red Hat Advisory, Red Hat Bugzilla).

The fix has been committed to the Linux kernel stable tree, adding a configfs_put(sd) call in the error path of configfs_create_dir() to correct the reference count. Patches are available in multiple stable kernel branches (commits 07f82dca, 8bc77754, 74ac7c9e, 90c38f57). Users should update to a patched kernel version as provided by their Linux distribution. Red Hat has tracked this issue with low severity/priority (Red Hat Bugzilla). SUSE has also issued kernel advisories addressing this CVE (Linux Security SUSE).