CVE-2022-50810: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50810 is a reference count leak vulnerability in the Linux kernel's RapidIO subsystem, specifically in the mport_cdev_open function within drivers/rapidio/devices/rio_mport_cdev.c. When kfifo_alloc fails during device open, the reference count of chdev->dev is incremented but never decremented, resulting in a refcount leak. The vulnerability affects Linux kernel versions from the introduction of the affected code (commit e8de370188d0) up to the patched stable releases. It was publicly disclosed on December 30, 2025, with an EPSS score of approximately 0.033% (very low), and no CVSS score has been formally assigned (Red Hat CVE, ENISA EUVD).

The root cause is improper reference counting (CWE-911: Improper Update of Reference Count) in the mport_cdev_open function of the Linux kernel's RapidIO character device driver. When kfifo_alloc() fails, the error handling path returns without calling put_device(&chdev->dev), leaving the device reference count permanently incremented. The fix adds the missing put_device() call in the failure path to correctly balance the reference count. Exploitation would require local access to a system with RapidIO hardware or the RapidIO kernel module loaded, and the ability to open the relevant character device (Red Hat CVE, Red Hat Bugzilla).

The primary impact of this vulnerability is a kernel resource leak — specifically, a reference count on a device object that is never released. Over time or under repeated triggering, this could prevent proper cleanup of the chdev->dev object, potentially leading to memory exhaustion or denial of service conditions on affected systems. The vulnerability does not directly enable remote code execution, privilege escalation, or data exfiltration, making its practical security impact limited to availability in scenarios where the RapidIO subsystem is actively used (Red Hat CVE).

There is no known public exploit code, no evidence of in-the-wild exploitation, and CVE-2022-50810 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033%, reflecting a very low probability of exploitation. Exploitation requires local access to a system with the RapidIO subsystem active, which is uncommon in typical deployments (Red Hat CVE, Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to the appropriate patched stable kernel release for their distribution. Red Hat has tracked this issue via Bugzilla (BZ#2426251); users of RHEL-based distributions should apply available kernel updates (Red Hat Bugzilla, Red Hat CVE).