CVE-2022-50809: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50809 is a memory leak vulnerability in the Linux kernel's xHCI Debug Capability (DbC) subsystem, specifically in the xhci_alloc_dbc() function. When DbC is already in use, the allocated memory for the xhci_dbc struct is not freed before the function returns NULL, resulting in a kernel memory leak (CWE-401). The vulnerability affects Linux kernel versions from commit 534675942e90 up to the patched commits in stable branches, with fixes backported to versions 5.15.75, 5.19.17, 6.0.3, and 6.1. It was published on December 30, 2025, and carries an EPSS score of 0.00018, indicating very low exploitation probability (Feedly, EUVD).

The root cause is a missing kfree() call in the error path of xhci_alloc_dbc() in the Linux kernel's xHCI DbC driver (CWE-401: Missing Release of Memory after Effective Lifetime). When the function detects that DbC is already in use and returns NULL, it fails to release the previously allocated xhci_dbc structure, causing a kernel heap memory leak. The fix involves adding the appropriate memory deallocation before the early return. This is a local kernel-level issue with no network attack vector, requiring the DbC subsystem to be in a specific state (already in use) to trigger the leak (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust available kernel memory over time if the vulnerable code path is triggered repeatedly. This affects system availability by potentially degrading performance or causing out-of-memory conditions on long-running systems. There is no direct confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched versions include Linux 5.15.75, 5.19.17, 6.0.3, and 6.1 (mainline). Administrators should update to a patched kernel version for their distribution. SUSE has also issued an advisory (SUSE-2026:0411-1) addressing this vulnerability. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (EUVD, Linux Security).