CVE-2022-50848: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50848 is a memory leak vulnerability in the Linux kernel's DIO (Direct I/O) subsystem, specifically within the dio_init() function in drivers/dio/dio.c. When device_register() returns an error, the allocated dev structure and its associated name string are not properly freed, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions from 2.6.29 up to the patched stable releases. It was published on December 30, 2025, and carries a CVSS estimate of Medium severity with an EPSS score of approximately 0.033% (Feedly).

The root cause is improper error handling in the dio_init() function (CWE-401: Missing Release of Memory after Effective Lifetime). When device_register() fails, the code does not invoke the appropriate cleanup routines, leaving the dev object and its kobject name string allocated but unreachable. The fix adds a release function to the device and replaces direct kfree() calls in the error path with put_device(), which triggers kobject_cleanup() to properly free the name, and the release function to free the dev structure itself. This is a local kernel-level issue triggered during driver initialization, not exploitable remotely (Feedly, Kernel Git).

The primary impact is a kernel memory leak, which can gradually exhaust kernel memory resources over time if the DIO driver initialization fails repeatedly. This affects system availability by potentially degrading performance or causing out-of-memory conditions on long-running systems. Confidentiality and integrity are not directly impacted, as the vulnerability does not expose sensitive data or allow unauthorized writes. The scope is limited to the local system running an affected Linux kernel version with the DIO driver (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Users should upgrade to the following patched versions or later: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2 (Feedly). No configuration-based workaround is available; applying the kernel update is the only remediation. Given the low severity and limited exploitability, this fix can be applied as part of routine kernel maintenance rather than as an emergency patch.