CVE-2022-50776: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50776 is a memory leak vulnerability in the Linux kernel's clock (clk) subsystem, specifically within the st_of_quadfs_setup() function. When st_clk_register_quadfs_pll() fails, the @lock resource is not properly freed before the function exits via the err_exit label, resulting in a memory leak. The vulnerability affects the Linux kernel across a wide range of versions and was published on December 24, 2025. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.033% (Red Hat CVE, ENISA EUVD).

The root cause is classified as improper resource cleanup on error path (CWE-401: Missing Release of Memory after Effective Lifetime). In st_of_quadfs_setup(), a mutex lock (@lock) is allocated early in the function. If the subsequent call to st_clk_register_quadfs_pll() fails, the error-handling path jumps to err_exit without first freeing the allocated @lock, leaving the memory unreleased. The fix ensures @lock is freed before the goto err_exit branch is taken. Patches have been applied across multiple stable kernel branches (Red Hat Bugzilla, ENISA EUVD).

Successful triggering of this vulnerability leads to gradual memory resource exhaustion on affected Linux systems. Over time, repeated failures in the clock subsystem initialization path can cause cumulative memory leaks, potentially degrading system stability and performance, and in extreme cases leading to resource starvation or system instability. The impact is limited to availability; there is no known confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation (Feedly).

Patches are available for multiple Linux kernel stable branches. Fixed versions include 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Administrators should update to the latest patched kernel version applicable to their distribution. As an interim measure, monitoring kernel logs and system memory usage for anomalies in the clock subsystem can help detect potential impact. SUSE has also issued advisories incorporating these fixes (Red Hat Bugzilla, ENISA EUVD).