CVE-2022-50775: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50775 is a reference count leak vulnerability in the Linux kernel's RDMA/hns (HiSilicon RoCE) driver, specifically in the hns_roce_mmap function. The flaw arises because rdma_user_mmap_entry_get_pgoff() acquires a reference that is never released via a corresponding rdma_user_mmap_entry_put() call. It was published on December 24, 2025, and affects Linux kernel versions starting from commit 0045e0d3f42e up to the fixes applied in stable branches (patched in 6.1.16, 6.2.3, and 6.3). The CVSS base score is not formally assigned (estimated Medium severity) (Feedly, ENISA EUVD).

The root cause is a missing reference count release (CWE-911: Improper Update of Reference Count) in the hns_roce_mmap function of the Linux kernel's RDMA/hns driver. When rdma_user_mmap_entry_get_pgoff() is called to look up a memory-mapped entry by page offset, it increments the object's reference count, but the corresponding rdma_user_mmap_entry_put() to decrement it upon completion is absent. This results in a reference count leak, meaning the kernel object is never properly freed. Exploitation requires local access to a system with HiSilicon RoCE (RDMA over Converged Ethernet) hardware and the ability to invoke mmap operations on the RDMA device (Feedly, Kernel Patch 1).

The primary impact of this vulnerability is a kernel memory leak, where RDMA mmap entry objects accumulate unreleased references over time. On systems with HiSilicon RoCE hardware under sustained RDMA workloads, this can lead to resource exhaustion and eventual denial of service as kernel memory is gradually consumed. There is no direct path to privilege escalation or data exfiltration identified from this vulnerability alone (Feedly, ENISA EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2022-50775. The EPSS score is extremely low at approximately 0.017%, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local attackers with access to systems equipped with HiSilicon RoCE network hardware (Feedly).

The fix has been backported to Linux kernel stable branches: version 6.1.16, 6.2.3, and 6.3. The patch adds the missing rdma_user_mmap_entry_put() call in hns_roce_mmap to properly release the reference acquired by rdma_user_mmap_entry_get_pgoff(). Administrators running affected kernel versions on systems with HiSilicon RoCE hardware should update to a patched kernel version. The relevant upstream commits are fa87cf2e756e, 8abd2ff2256a, and cf6a05c8494a (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).