CVE-2022-50754: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50754 is a memory leak vulnerability in the Linux kernel's AppArmor security module, specifically within the multi_transaction_new() function. When copy_from_user() fails, the allocated variable t is neither freed nor passed out of the function, resulting in a kernel memory leak. The vulnerability was disclosed on December 24, 2025, and affects Linux kernel versions from 4.13 onward, with patches available across multiple stable branches. The CVSS base score is not formally assigned (estimated Medium severity by Feedly), and the EPSS score is approximately 0.024% (Red Hat CVE, ENISA EUVD).

The root cause is a missing memory deallocation on an error path in the AppArmor kernel module (CWE-401: Missing Release of Memory after Effective Lifetime). In multi_transaction_new(), a transaction object t is allocated, but if the subsequent copy_from_user(t->data, buf, size) call fails (e.g., due to a fault copying data from user space), the function returns an error without calling put_multi_transaction(t) to release the allocated memory. The fix adds the missing put_multi_transaction(t) call in the error path. The vulnerability was introduced at commit 1dea3b41e84c and is reachable by a local user with sufficient privileges to interact with AppArmor's transaction interface (Red Hat CVE, Red Hat Bugzilla).

Successful repeated triggering of this vulnerability causes gradual kernel memory exhaustion on affected Linux systems running AppArmor. Over time, this can degrade system performance, reduce available memory for other processes, and potentially lead to system instability or unexpected application crashes. There is no direct confidentiality or integrity impact; the primary risk is availability degradation through resource exhaustion (Red Hat CVE).

Patches have been backported to multiple stable Linux kernel versions. Users should update to one of the following patched releases or later: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2. Distribution-specific updates (e.g., SUSE, Red Hat) are also available through vendor security repositories. Monitoring system memory usage can help detect anomalous kernel memory growth in the interim (Red Hat CVE, Red Hat Bugzilla).