CVE-2022-50832: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50832 is a memory leak vulnerability in the Linux kernel's wilc1000 Wi-Fi driver, specifically in the wilc_mac_xmit() function. The function returns NETDEV_TX_OK without freeing the socket buffer (skb), resulting in a potential memory leak during network transmission. It affects Linux kernel versions from the introduction of the wilc1000 driver (commit c5c77ba18ea6) up to the patched stable releases. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000240 (Feedly, ENISA EUVD).

The root cause is a missing dev_kfree_skb() call in the wilc_mac_xmit() function within the wilc1000 Wi-Fi driver (drivers/net/wireless/microchip/wilc1000/), classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When the function encounters certain error or early-return conditions, it returns NETDEV_TX_OK to the network stack without releasing the allocated socket buffer, causing kernel memory to leak over time. This is a local, in-kernel issue triggered through normal network transmission operations on devices using the WILC1000 chipset. The fix adds a dev_kfree_skb() call to properly release the skb before returning (Feedly, Kernel Patch).

The primary impact is a gradual kernel memory leak on systems using the WILC1000 Wi-Fi chipset, which can degrade system performance and stability over time. Repeated triggering of the vulnerable code path could eventually exhaust kernel memory, potentially leading to a denial-of-service condition. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include Linux 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Users should update to these or later stable kernel releases. Systems not using the WILC1000 Wi-Fi chipset are unaffected; as a workaround, the wilc1000 kernel module can be blacklisted on systems that do not require it (Kernel Patch, ENISA EUVD).