CVE-2022-50824: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50824 is a memory leak vulnerability in the Linux kernel's TPM (Trusted Platform Module) subsystem, specifically in the tpm_tis driver. The flaw exists in the check_acpi_tpm2() function, which retrieves the ACPI TPM2 table during initialization but fails to call acpi_put_table() to release the associated ACPI memory afterward. The vulnerability was published on December 30, 2025, and affects Linux kernel versions from 4.13 up to the patched stable releases. No CVSS score has been assigned as of the time of this report, and the EPSS score is approximately 0.024% (Feedly, EUVD).

The root cause is a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime) in the Linux kernel's tpm_tis driver. During kernel initialization, check_acpi_tpm2() calls the ACPI subsystem to locate the TPM2 table to verify its presence, but does not invoke acpi_put_table() after the check, causing the ACPI memory mapping to remain allocated for the lifetime of the kernel. The fix involves adding the missing acpi_put_table() call after the table lookup is complete, which was backported across multiple stable kernel branches (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which can gradually degrade system availability over time as ACPI memory is not reclaimed after TPM initialization. On systems with TPM 2.0 hardware and ACPI support, this leak occurs at every boot, potentially contributing to memory pressure in long-running or resource-constrained environments. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched versions include: 4.19.270, 4.14.303, 5.4.229, 5.10.163, 5.15.87, 6.0.17, 6.1.3, and 6.2. Users should update to the appropriate patched stable release for their kernel series. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (EUVD, Feedly).