CVE-2022-50836: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50836 is a memory leak vulnerability in the Linux kernel's remoteproc/sysmon subsystem, specifically within the qcom_add_sysmon_subdev() function. The flaw occurs when of_irq_get_byname() or devm_request_threaded_irq() fails without a corresponding kfree() call, resulting in a kernel memory leak. It affects Linux kernel versions starting from the introduction of commit 027045a6e2b7, with fixes backported to stable releases including 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The vulnerability was published on December 30, 2025, and is estimated as Medium severity with an EPSS score of 0.000240 (Feedly, EUVD).

The root cause is a missing memory deallocation (CWE-401: Missing Release of Memory after Effective Lifetime) in the qcom_add_sysmon_subdev() function within drivers/remoteproc/qcom_sysmon.c. When either of_irq_get_byname() or devm_request_threaded_irq() returns an error, the previously allocated memory is not freed via kfree(), causing a kernel memory leak on error paths. The fix adds the missing kfree() calls in the relevant error-handling branches. This is a local kernel-level issue with no network-facing attack surface (Feedly, EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on affected systems over time, potentially leading to degraded system performance or denial of service in long-running environments. The vulnerability does not directly enable code execution, privilege escalation, or data exfiltration. It is limited in scope to systems using Qualcomm remoteproc/sysmon subsystems (e.g., devices with Qualcomm SoCs running affected Linux kernel versions) (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50836. The EPSS score is very low at 0.000240, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with a Qualcomm remoteproc/sysmon driver and the ability to trigger error conditions in qcom_add_sysmon_subdev() (Feedly).

The Linux kernel project has released fixes backported to the following stable versions: 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to one of these patched versions or any later release. The fix adds kfree() calls in the error-handling paths of qcom_add_sysmon_subdev(). Patch commits are available in the Linux stable kernel repository (EUVD, Kernel Patch).