CVE-2022-50874: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50874 is a reference count leak vulnerability in the Linux kernel's RDMA/erdma subsystem, specifically within the erdma_mmap function. The flaw arises because rdma_user_mmap_entry_get() increments a reference count that is never released in certain error paths, as the corresponding rdma_user_mmap_entry_put() call was missing. It affects Linux kernel versions starting from the introduction of the erdma driver (commit 155055771704) up to the fixes applied in stable releases 6.1.16, 6.2.3, and 6.3. The vulnerability was published on December 30, 2025, with an EPSS score of approximately 0.017% (very low), and no CVSS base score has been assigned (Feedly, EUVD).

The root cause is a missing resource release in an error path, classified as CWE-401 (Missing Release of Memory after Effective Lifetime) or more broadly as a reference count management error. In the erdma_mmap function of the Linux kernel's RDMA erdma driver, rdma_user_mmap_entry_get() is called to obtain a reference to a user mmap entry, but if a subsequent error condition is encountered, the function returns without calling rdma_user_mmap_entry_put() to release that reference. This causes the reference count to be permanently incremented, preventing the associated memory or object from being freed. The fix adds the missing rdma_user_mmap_entry_put() call in the error path (Feedly, Kernel Fix 1, Kernel Fix 2).

The primary impact of this vulnerability is a kernel memory leak, where repeated triggering of the error path in erdma_mmap causes reference counts to accumulate without being released. Over time, this can lead to resource exhaustion and potential denial of service on systems using the erdma RDMA driver. There is no known direct path to privilege escalation, remote code execution, or data exfiltration from this vulnerability; the impact is limited to availability of the affected system (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50874. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. Exploitation would require local access to a system running the affected erdma RDMA driver and the ability to trigger the error path in erdma_mmap (Feedly).

The Linux kernel stable tree has released patches addressing this vulnerability in versions 6.1.16, 6.2.3, and 6.3. Administrators should update their Linux kernel to one of these patched versions or any later stable release. The specific fix commits are available at the kernel stable repository (Kernel Fix 1, Kernel Fix 2, Kernel Fix 3). As a workaround, systems that do not use the erdma RDMA driver can unload or blacklist the erdma kernel module to eliminate exposure.