CVE-2022-50855: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50855 is a resource leak vulnerability in the Linux kernel's BPF subsystem, specifically in the LSM (Linux Security Module) program attachment path for cgroups. When attaching an LSM BPF program to a cgroup via bpf_prog_attach, a validation failure causes an early return without decrementing the program's reference count (bpf_prog_put), leaving the LSM program alive beyond its expected lifecycle. The vulnerability affects Linux kernel versions starting from the introduction of BPF_LSM_CGROUP support (commit 69fd337a975c) up to the fixes applied in stable releases 6.0.16, 6.1.2, and 6.2. It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.017% (Feedly, EUVD).

The root cause is a missing reference count decrement (CWE-401: Missing Release of Memory after Effective Lifetime / resource leak) in the bpf_prog_attach code path for LSM programs attached to cgroups. When the validation check to confirm the program is of type BPF_LSM_CGROUP fails, the function returns an error code prematurely without calling bpf_prog_put() to release the program reference. This means the BPF LSM program's reference count remains elevated, preventing proper cleanup and keeping the program object alive in kernel memory beyond its intended lifecycle. The fix, applied across three stable kernel branches, ensures bpf_prog_put() is called on the error path (Feedly, EUVD).

The primary impact is a kernel memory resource leak: a BPF LSM program object persists in kernel memory after a failed attachment attempt, consuming kernel resources and potentially causing memory exhaustion over time if triggered repeatedly. This is an availability concern rather than a direct confidentiality or integrity breach. There is no evidence of privilege escalation, data exfiltration, or lateral movement potential associated with this vulnerability (Feedly).

The Linux kernel maintainers have released patches across three stable branches. Fixed versions include kernel 6.0.16, 6.1.2, and 6.2 (mainline). The relevant commits are 82b39df5ddb298daaf6dc504032ff7eb027fa106 (6.0.x branch), 6a1504dd36cd9a0a69250d61da8bdb17b29f1fe8 (6.1.x branch), and e89f3edffb860a0f54a9ed16deadb7a4a1fa3862 (mainline). Administrators should update to a patched kernel version. As a workaround, restricting unprivileged access to BPF syscalls (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl) reduces exposure, though the vulnerability primarily requires local privileged access (EUVD, Feedly).