CVE-2022-50821: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50821 is a memory leak vulnerability in the Linux kernel's SUNRPC subsystem, specifically in the gss_read_proxy_verf() function, where netobj memory is not properly freed upon failure. The vulnerability was published on December 30, 2025, and affects multiple stable Linux kernel branches originating from commit 030d794bf498. Fixed versions include Linux kernel 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.17, 6.1.3, and 6.2. No CVSS score has been assigned at this time, and the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the SUNRPC GSS (Generic Security Services) proxy verification path. When gss_read_proxy_verf() encounters an error condition, it returns without freeing the netobj structure that was previously allocated, resulting in a kernel memory leak. The fix was applied across multiple stable kernel branches via patches to the net/sunrpc/auth_gss/svcauth_gss.c file (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems over time. In environments where SUNRPC/NFS with GSS proxy authentication is heavily used, repeated triggering of the error path could degrade system performance or contribute to denial-of-service conditions. There is no known direct path to privilege escalation, remote code execution, or data exfiltration from this vulnerability alone (Feedly).

Update the Linux kernel to a patched version: 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.17, 6.1.3, or 6.2 (mainline). Distribution-specific updates are available from vendors such as SUSE (addressed in SUSE security updates). As a workaround, disabling GSS proxy authentication for SUNRPC/NFS services may reduce exposure, though upgrading to a patched kernel is the recommended remediation (Feedly, EUVD).

Coverage of this vulnerability has been limited to routine security advisory channels, including Tenable Nessus plugin detections (281559, 301595) and Qualys detections (760644, 760731), as well as SUSE security advisories. No notable researcher commentary or significant social media discussion has been observed (Feedly).