CVE-2022-50813: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50813 is a resource leak vulnerability in the Linux kernel's MCB (MEN Chameleon Bus) driver. Specifically, when the probe hook function fails inside mcb_probe(), the device is not properly released via put_device(), resulting in a resource leak. The vulnerability was published on December 30, 2025, and affects Linux kernel versions from 4.7 onward across multiple stable branches. No CVSS score has been assigned (base score 0.0), and the EPSS score is approximately 0.033% (Red Hat CVE, CIRCL).

The root cause is a missing put_device() call in the error-handling path of mcb_probe() in the Linux kernel's MCB driver (CWE-401: Missing Release of Memory after Effective Lifetime). When the probe hook function returns an error, the driver fails to decrement the device reference count, leaving the device object unreleased. This is a local, kernel-level issue requiring the presence of MCB (MEN Chameleon Bus) hardware or a simulated probe failure to trigger. The fix was noted as a compiled-test-only change, indicating the issue was identified through code review rather than runtime testing (Red Hat CVE, CIRCL).

Repeated probe failures on MCB devices could cause unreleased device references to accumulate, potentially leading to memory and resource exhaustion over time and degrading system stability and availability. The impact is limited to systems equipped with MCB (MEN Chameleon Bus) hardware, which is a niche industrial bus interface. There is no known confidentiality or integrity impact; the primary concern is availability through gradual resource exhaustion (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-50813. The EPSS score is approximately 0.033%, reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (CIRCL, Red Hat CVE).

Update the Linux kernel to a patched stable version: 4.9.337+, 4.14.303+, 4.19.270+, 5.4.229+, 5.10.163+, 5.15.86+, 6.0.16+, 6.1.2+, or 6.2+. Patches are available via the upstream stable kernel tree. Given the low severity and niche hardware requirement (MCB devices), patching can be scheduled during regular maintenance windows rather than treated as an emergency update (Red Hat CVE, Red Hat Bugzilla).