CVE-2022-50827: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50827 is a memory leak vulnerability in the Linux kernel's SCSI lpfc driver, specifically within the lpfc_create_port() function. The flaw was introduced by commit 5e633302ace1 ("scsi: lpfc: vmid: Add support for VMID in mailbox command"), which added VMID resource allocations after scsi_host_alloc() but failed to call scsi_host_put() on the error path, resulting in a memory leak. The vulnerability affects Linux kernel versions from 5.14 onward, with fixes backported to stable releases 5.15.76, 6.0.6, and 6.1. It was published on December 30, 2025, and carries an EPSS score of 0.000170, indicating very low exploitation probability (Feedly, EUVD). No CVSS score has been assigned.

The root cause is a missing resource cleanup on the error path in lpfc_create_port() (CWE-401: Missing Release of Memory after Effective Lifetime). When VMID resource allocations fail, the code branches to the out label, which returns NULL without calling scsi_host_put() to release the previously allocated SCSI host structure. The fix introduces a new out_free_vmid label to properly unwind VMID resources before falling through to out_put_shost, which exclusively handles the scsi_host_put() call — restoring the pre-VMID error-handling behavior. This is a local, kernel-level issue triggered only under specific allocation failure conditions (Feedly, EUVD).

The vulnerability results in a kernel memory leak when VMID resource allocation fails during port creation in the lpfc (Emulex LightPulse Fibre Channel) driver. Over time, repeated triggering of this code path could exhaust kernel memory, potentially degrading system stability or availability. There is no direct impact on confidentiality or integrity, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

Apply the upstream kernel patches that introduce the out_free_vmid label fix. The fix has been backported to the following stable kernel versions: 5.15.76, 6.0.6, and 6.1 (mainline). Users running affected kernels (5.14 and later, prior to the fix commits) should update to a patched release. SUSE has also issued a security advisory (SUSE-2026-0350-1) addressing this and related kernel issues (Feedly, Linux Security).

Coverage of CVE-2022-50827 has been limited to routine vulnerability tracking by security aggregators such as VulDB, Vulners, and Tenable (Nessus plugin 281467), as well as a CISA weekly vulnerability summary for the week of December 29, 2025. No notable researcher commentary or significant community discussion has been identified (Feedly).