CVE-2022-50857: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50857 is a memory/resource leak vulnerability in the Linux kernel's RapidIO subsystem, specifically in the rio_register_mport() function. When device_register() returns an error, the name allocated by dev_set_name() is not properly freed, resulting in a name leak; additionally, the port is not removed from the rio_mports list in the error path. The vulnerability affects Linux kernel versions from commit 2aaf308b95b2 up to the respective fix commits across multiple stable branches. It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.033% (Feedly, EUVD).

The root cause is improper error handling in the rio_register_mport() function within the Linux kernel's RapidIO driver (drivers/rapidio/rio.c), classified as a missing resource release on error path (CWE-401: Missing Release of Memory after Effective Lifetime). When device_register() fails, the code does not call put_device() to release the reference, which would normally trigger kobject_cleanup() to free the name string set by dev_set_name(). Furthermore, the port entry is not removed from the rio_mports list via list_del(), leaving a dangling reference. The fix replaces direct error-path cleanup with a put_device() call and adds the missing list_del() (Feedly, EUVD).

The primary impact is a kernel memory leak — specifically, the device name string allocated during RapidIO master port registration is not freed on registration failure, and the port remains incorrectly listed in rio_mports. Over time or under repeated error conditions, this could contribute to kernel memory exhaustion, potentially degrading system stability or availability. The vulnerability does not directly enable code execution, privilege escalation, or data exfiltration, making its confidentiality and integrity impact negligible (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50857. The vulnerability requires local kernel-level conditions related to RapidIO hardware initialization failures, making it difficult to trigger in typical environments. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and its EPSS score is approximately 0.033%, reflecting very low exploitation probability (Feedly, Tenable).

The Linux kernel maintainers have released fixes across multiple stable branches. Patched versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to the appropriate patched kernel version for their distribution. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, EUVD).