CVE-2022-50830: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50830 is a memory leak vulnerability in the Linux kernel's auxdisplay hd44780 driver. The flaw exists in the hd44780_remove() function, which fails to free the memory allocated by hd44780_probe() for the lcd->drvdata->hd44780 structure via kzalloc(). It affects Linux kernel versions from 5.11 up to the patched releases (5.15.100, 6.1.18, 6.2.5, and 6.3). The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000180 (Red Hat CVE, Feedly).

The root cause is a missing memory deallocation in the hd44780_remove() function of the Linux kernel's drivers/auxdisplay/hd44780.c, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During device probe, hd44780_probe() allocates a memory chunk using kzalloc() and assigns it to lcd->drvdata->hd44780; however, when the device is removed, hd44780_remove() does not call kfree() on this pointer, leaving the allocation unreleased. The fix involves adding the appropriate kfree() call in hd44780_remove() and is available across multiple stable kernel branches (Kernel Patch 6.1, Kernel Patch 5.15).

Repeated insertion and removal of hd44780 auxdisplay devices causes progressive, unreclaimed kernel memory consumption. Over time, this can lead to memory exhaustion, system instability, or denial of service conditions. The impact is most significant on embedded or long-running systems where device hot-plug cycles occur frequently; there is no confidentiality or integrity impact associated with this vulnerability (Feedly).

There is no known public proof-of-concept exploit for CVE-2022-50830, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at 0.000180, reflecting minimal exploitation probability (Feedly, Red Hat CVE).

Update the Linux kernel to a patched version: 5.15.100, 6.1.18, 6.2.5, or 6.3 (or later). The fix adds a kfree() call for lcd->drvdata->hd44780 in the hd44780_remove() function. As a temporary workaround on systems where kernel updates cannot be immediately applied, limit or avoid frequent hot-plug cycles of hd44780 auxdisplay devices to reduce the rate of memory accumulation (Kernel Patch 6.1, Kernel Patch 5.15, Feedly).