CVE-2022-50759: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50759 is a memory leak vulnerability in the Linux kernel's media subsystem, specifically in the OV5648 image sensor driver (media/i2c/ov5648). The flaw occurs because the V4L2 fwnode data structure is not freed when the driver is unbound, resulting in a kernel memory leak. It was published on December 24, 2025, and affects Linux kernel versions starting from the introduction of the OV5648 driver (around kernel 5.12) up to the patched stable releases. The CVSS base score is 0.0 per ENISA/EUVD data, and Feedly estimates the severity as Medium (Feedly, EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the OV5648 camera sensor driver's unbind path. When the driver is unbound from the device, the V4L2 fwnode data structure allocated during probe is never released, causing a kernel memory leak. Exploitation requires local access to a system with the OV5648 sensor driver loaded and the ability to repeatedly bind/unbind the driver (e.g., via USB hotplug or module reload). Fixes were applied to stable kernel branches via commits 3a54b728, 4a34fd4d, and c95770e4 (Kernel Git, Kernel Git, Kernel Git).

The primary impact is a kernel memory leak that gradually reduces available memory on affected systems over time, particularly on devices that repeatedly bind and unbind the OV5648 camera sensor driver. In embedded or IoT systems where this sensor is commonly used, sustained memory exhaustion could degrade system stability or cause denial of service. There is no known confidentiality or integrity impact; the vulnerability does not enable code execution or privilege escalation (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50759. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local contexts on hardware equipped with the OV5648 image sensor (Feedly).

The fix has been backported to stable Linux kernel releases: 6.0.16, 6.1.2, and 6.2. Users should update to these or later stable kernel versions. For systems where upgrading is not immediately possible, unloading the ov5648 kernel module (if not required) can prevent the leak from occurring. No configuration-based workaround is available beyond avoiding repeated bind/unbind cycles of the affected driver (Kernel Git, OpenSUSE Bugzilla).

The vulnerability has received minimal public attention, consistent with its low severity and limited attack surface. OpenSUSE tracked the issue via their bugzilla system, and Tenable published a Nessus plugin (ID 279996) to detect affected systems. No notable researcher commentary or media coverage has been identified (OpenSUSE Bugzilla, Tenable).