CVE-2022-50863: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50863 is a memory leak vulnerability in the Linux kernel's rtw89 Wi-Fi driver. The flaw occurs when unused socket buffers (skbs) are not freed under power saving mode, leading to a potential memory leak. It was published on December 30, 2025, and affects Linux kernel versions prior to the patched releases 5.19.17, 6.0.3, and 6.1. The CVSS base score is reported as 0.0 (no official severity assigned), with Feedly estimating it as Medium severity (Feedly, EUVD).

The root cause is a missing kfree_skb() (or equivalent) call in the rtw89 Wi-Fi driver's power saving code path, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When the driver enters power saving mode, certain socket buffers allocated for Wi-Fi packet handling are not properly released, causing kernel memory to be consumed without being freed. The fix was applied across three stable kernel branches via commits d4b4f6ff8ff1, 216c59b66f2d, and eae672f38604 (Feedly, EUVD).

The primary impact is a gradual kernel memory leak on systems using the rtw89 Wi-Fi driver when power saving mode is active. Over time, this can degrade system performance and potentially lead to memory exhaustion, causing denial of service (system instability or crash). There is no known confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

Update the Linux kernel to a version containing the fix: 5.19.17 or later, 6.0.3 or later, or 6.1 or later. The patches are available via the stable kernel tree at the referenced commits. As a temporary workaround, disabling power saving mode for the rtw89 Wi-Fi adapter (e.g., via iw dev <interface> set power_save off) may prevent the vulnerable code path from being triggered (EUVD, Feedly).