CVE-2022-50822: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50822 is a memory leak vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically in the resource tracking (restrack) component. The flaw occurs because the Memory Region (MR) restrack entry is not properly released upon deletion, causing the associated task struct to remain unreleased and resulting in a kernel memory leak. It affects Linux kernel versions from commit 13ef5539def7 up to several stable branch fix points. The vulnerability was published on December 30, 2025, and carries an EPSS score of approximately 0.018% (very low exploitation probability) (Feedly, CIRCL).

The root cause is classified as a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime). In the Linux kernel's RDMA/restrack subsystem, when a Memory Region (MR) object is deleted, the associated restrack entry is not freed, preventing the kernel from releasing the underlying task struct. This results in a gradual kernel memory leak that can accumulate over time with repeated MR allocation and deallocation operations. The fix was applied across multiple stable kernel branches via commits to git.kernel.org/stable (Feedly, kernel.org).

The primary impact of CVE-2022-50822 is an availability degradation due to kernel memory exhaustion over time. Systems that heavily utilize RDMA Memory Regions — such as high-performance computing (HPC) nodes, storage appliances, or network-intensive servers — are most at risk, as repeated MR creation and deletion will gradually consume kernel memory without releasing it. There is no known confidentiality or integrity impact; the vulnerability does not enable privilege escalation or unauthorized data access (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include kernel 5.15.86, 6.0.16, 6.1.2, and 6.2, with corresponding commits available on git.kernel.org. Downstream distributions including SUSE and Amazon Linux 2 (kernel 5.10) have also issued updated packages addressing this vulnerability. Administrators should update to a patched kernel version as soon as possible; no configuration-based workaround is available (Feedly, Linux Security, Amazon Linux).