CVE-2022-50757: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50757 is a vulnerability in the Linux kernel's media camss driver where received video buffers are not properly cleaned up when streaming fails to start. When media_pipeline_start() fails with EPIPE due to link validation errors between media entities, the driver's error path in video_start_streaming() does not return the queued buffers, resulting in a kernel warning. The vulnerability affects Linux kernel versions from commit 0ac2586c410f up to multiple stable branches, with patches available for versions 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. It carries a medium severity estimate with an EPSS score of approximately 0.024% (Red Hat CVE, Red Hat Bugzilla).

The root cause is an improper error path in the video_start_streaming() function within the Linux kernel's Qualcomm Camera Subsystem (camss) driver (CWE-459: Incomplete Cleanup). When media_pipeline_start() returns EPIPE due to a failed link validation between V4L2 media entities, the driver fails to return the already-queued video buffers back to the videobuf2 core, violating the expected contract of the vb2_start_streaming interface. This triggers a kernel WARN_ON at drivers/media/common/videobuf2/videobuf2-core.c:1592, producing a call trace through vb2_start_streaming, vb2_core_streamon, vb2_ioctl_streamon, and v4l2_ioctl. The fix corrects the error path to properly return buffers when streaming initialization fails (Red Hat CVE).

Exploitation of this vulnerability results in kernel warnings and potential system instability on affected Linux systems using the Qualcomm camss media driver. The primary impact is an availability concern — unreturned video buffers can cause resource leaks and kernel warning states, potentially destabilizing the media subsystem. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Red Hat CVE, Red Hat Bugzilla).

Update the Linux kernel to a patched version addressing this issue. Patches have been backported to the following stable kernel releases: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. As a workaround, ensure proper link validation between media entities is configured before attempting video streaming, and monitor kernel logs for warnings related to vb2_start_streaming. Administrators should apply vendor-specific kernel updates (e.g., SUSE, Red Hat) that incorporate these upstream fixes (Red Hat Bugzilla, Red Hat CVE).