CVE-2022-50765: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50765 is a memory leak vulnerability in the Linux kernel's RISC-V kexec implementation, specifically within the ELF header buffer handling during kdump kernel loading. The flaw was disclosed on December 24, 2025, and affects Linux kernel versions from commit 8acea455fafaf2620b247de6c00774828b618a82 up to the patched releases. Fixed versions include Linux kernel 6.0.18, 6.1.4, and 6.2. It carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.017% (Red Hat CVE, Feedly).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the RISC-V kexec code path. In elf_kexec_load(), a 4096-byte buffer is allocated via vzalloc() inside crash_prepare_elf64_headers() to store ELF headers for the kdump kernel. This buffer is never freed when the kdump kernel is reloaded, unloaded, or when loading fails after image->elf_header is set. The fix involves freeing the buffer in arch_kimage_file_post_load_cleanup() to ensure proper cleanup in all code paths (Red Hat CVE, kernel.org patch).

The vulnerability results in a kernel memory leak of at least 4096 bytes per kexec/kdump operation on RISC-V systems. Repeated triggering of the vulnerable code path (e.g., repeated kdump kernel reloads) could gradually exhaust kernel virtual memory, potentially degrading system availability. There is no direct confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution.

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50765. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a RISC-V system with the ability to invoke kexec_file_load syscalls, limiting the practical attack surface (Feedly).

The vulnerability is patched in Linux kernel versions 6.0.18, 6.1.4, and 6.2. Administrators running RISC-V systems with kdump enabled should update to one of these patched kernel versions. The corresponding upstream commits are 090bfcfc9f14, cdea2da67875, and cbc32023ddbd. As a workaround, disabling kdump/kexec functionality on affected RISC-V systems eliminates exposure to this code path (kernel.org patch, Red Hat CVE).