CVE-2022-50779: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50779 is a kernel memory leak (kmemleak) vulnerability in the Linux kernel's OrangeFS filesystem driver, specifically within the orangefs_prepare_debugfs_help_string() function. The flaw causes the debug_help_string buffer (4096 bytes, allocated via kmalloc) to not be freed when the orangefs module is removed, resulting in a memory leak. It affects Linux kernel versions from the initial commit through multiple stable branches, with fixes backported to versions 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2+. The vulnerability was published on December 24, 2025, and is estimated as Medium severity (Feedly, EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the OrangeFS kernel module. When the orangefs module is loaded, orangefs_prepare_debugfs_help_string() allocates a 4096-byte buffer via kmalloc_trace for debug_help_string. However, when the module is subsequently unloaded, this buffer is never freed, nor is it freed when free_debug_help_string is changed. The leak is local in nature — it requires the ability to load and unload kernel modules, which typically requires elevated (root) privileges. The fix ensures debug_help_string is always freed on module removal and when the associated flag changes (Feedly, EUVD).

The primary impact is a kernel memory leak that gradually reduces available kernel memory each time the orangefs module is inserted and removed. This can degrade system availability over time, particularly on systems that frequently load and unload the module, potentially contributing to memory exhaustion. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

Apply the relevant patched Linux kernel version for your branch: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2+. The fix ensures debug_help_string is freed on module unload and when free_debug_help_string is toggled. As a workaround, avoid repeatedly loading and unloading the orangefs kernel module on affected systems until a patch is applied. SUSE has also issued an advisory (kernel-suse-2026-0411-1-2022-0854) addressing this issue (Feedly, Linux Security).