CVE-2022-50854: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50854 is a memory leak vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem, specifically in the virtual_nci_send() function of the nfc/virtual_ncidev driver. The flaw occurs because socket buffers (skb) allocated during NCI command transmission are not properly freed, causing kernel memory to leak. It was published on December 30, 2025, and affects Linux kernel versions from commit e624e6c3e777fb3dfed036b9da4d433aee3608a5 up to the patched stable releases. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.017% (Feedly, ENISA EUVD).

The root cause is a missing kfree_skb() call in the virtual_nci_send() function within drivers/nfc/virtual_ncidev.c, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When the virtual NCI device sends a command (e.g., during nci_dev_up → nci_reset_req → nci_send_cmd), an skb is allocated via __alloc_skb but never freed upon completion of the send path in the virtual driver. The leak can be reproduced using the kernel's own NCI self-test tooling (tools/testing/selftests/nci/nci_dev) in a QEMU environment, and kmemleak will report the unreferenced object. Patches were applied to stable branches at commits 88e879c9f595, 2c46a9a5f0b1, and e840d8f4a1b3 (Feedly, ENISA EUVD).

The primary impact is a kernel memory leak in systems using the Linux virtual NCI (NFC Controller Interface) device driver. Over time, repeated triggering of the vulnerable code path can exhaust kernel memory, potentially degrading system performance or causing denial of service. This vulnerability does not directly enable remote code execution or privilege escalation, and its impact is limited to availability on systems where the NFC virtual device is in use (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50854. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with the NFC virtual device driver loaded and the ability to trigger NCI device bring-up operations (Feedly).

Apply the upstream Linux kernel patches that fix the memory leak by adding the missing kfree_skb() call in virtual_nci_send(). Fixed versions include Linux kernel stable releases 5.15.77, 6.0.7, and 6.1 and later, corresponding to commits 88e879c9f595 (for one stable branch), 2c46a9a5f0b1 (for another), and e840d8f4a1b3. Users should update to a patched kernel version provided by their Linux distribution. As a workaround, systems that do not require NFC virtual device functionality can unload or blacklist the virtual_ncidev kernel module to prevent the vulnerable code path from being triggered (ENISA EUVD).