CVE-2022-50837: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50837 is a memory leak vulnerability in the Linux kernel's DSA (Distributed Switch Architecture) subsystem, specifically in the net/dsa/tag_8021q.c component. The flaw causes the tag_8021q context of a switch to leak if dsa_tag_8021q_setup() fails during dsa_tag_8021q_register() — for example, when a device cannot install a VLAN — because the context is not freed on the error path. It affects Linux kernel versions from commit 328621f6131f up to the fixes introduced in stable branches. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a missing memory deallocation on an error path (CWE-401: Missing Release of Memory after Effective Lifetime). In dsa_tag_8021q_register(), when dsa_tag_8021q_setup() returns an error — such as when the underlying network device cannot install a VLAN entry — the previously allocated tag_8021q context structure is not freed before the function returns, resulting in a kernel memory leak. The fix ensures the context is released on all error paths. Patches were applied to stable kernel branches at commits 09f30f394e83 (5.15.x), 14ed46a13aba (6.0.x), 39691d51af99 (6.1.x), and e095493091e8 (mainline/6.2) (Kernel Git, EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust kernel memory resources on affected systems over time, potentially leading to degraded system performance or denial of service if the error condition is triggered repeatedly. The vulnerability is confined to the DSA subsystem and does not directly enable remote code execution, privilege escalation, or data exfiltration. Systems using DSA-based network switches with VLAN configuration failures are most at risk (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50837. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.018%, reflecting minimal exploitation probability (Feedly). Triggering the leak requires local access or control over network device configuration that causes VLAN installation failures in the DSA subsystem.

The vulnerability is fixed in Linux kernel stable releases: 5.15.86, 6.0.16, 6.1.2, and 6.2 (mainline). Administrators should update to these or later versions of the affected stable branches. No specific configuration-based workaround is documented; the recommended action is to apply the relevant kernel update for the branch in use (Kernel Git, EUVD). Linux distribution vendors such as SUSE and Red Hat have also issued advisories tracking this CVE (Vulners SUSE, Vulners RedHat).