CVE-2022-50758: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50758 is a potential memory leak vulnerability in the Linux kernel's staging: vt6655 wireless driver. The flaw exists in the device_init_td0_ring function, where memory allocated for the td_info member of priv->apTD0Rings[i] is not fully released when an allocation failure occurs — specifically, the case where i=0 is omitted from the cleanup loop. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the respective fix commits across multiple stable branches. The CVSS score is estimated as Medium, with an EPSS score of approximately 0.024% (Feedly, EUVD).

The root cause is a missing iteration in the error-handling cleanup loop within device_init_td0_ring in the staging/vt6655 driver (CWE-401: Missing Release of Memory after Effective Lifetime). When memory allocation for priv->apTD0Rings[i]->td_info fails partway through initialization, the rollback loop decrements i but stops before reaching index 0, leaving the allocation at index 0 unreleased. The fix modifies the loop boundary condition to include i=0, ensuring all previously allocated entries are freed on failure. This is a local kernel-level issue triggered during driver initialization, requiring the vt6655 hardware or module to be present (Feedly, EUVD).

The primary impact is a kernel memory leak in systems using the VIA VT6655 wireless LAN driver, which is part of the Linux kernel staging tree. Repeated triggering of the faulty allocation path could gradually exhaust kernel memory, potentially degrading system stability or availability over time. The vulnerability does not directly enable code execution, privilege escalation, or data exfiltration, making its practical security impact limited (Feedly).

Patches have been backported to multiple Linux stable kernel branches: 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. Administrators should update to a patched kernel version for their respective branch. If the vt6655 driver is not required, blacklisting or removing the vt6655 kernel module is an effective workaround to eliminate exposure. SUSE has also issued advisories (SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0350, SUSE-2026-0411) addressing this issue in their kernel packages (Feedly, Linux Security).