CVE-2022-50882: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50882 is a memory leak vulnerability in the Linux kernel's uvcvideo driver, specifically within the uvc_gpio_parse function. The flaw occurs because a unit buffer was allocated before checking the IRQ for a privacy GPIO; if an error occurs during the IRQ check, the allocated buffer is never freed, resulting in a resource leak. The vulnerability was identified via Coverity static analysis (ID: 1474639) and publicly disclosed on December 30, 2025. It affects Linux kernel versions from commit 2886477ff987 up to the respective fix commits across stable branches, with patches applied in versions 5.15.75, 5.19.17, 6.0.3, and 6.1. The CVSS base score is not formally assigned (estimated Medium by Feedly) (Feedly, ENISA EUVD).

The root cause is a resource leak (CWE-401: Missing Release of Memory after Effective Lifetime) in the uvc_gpio_parse() function of the Linux kernel's drivers/media/usb/uvc/uvc_driver.c. The unit buffer was allocated with kzalloc (or equivalent) prior to a call that checks for a valid IRQ associated with a privacy GPIO pin; if that IRQ check fails and returns an error, the function exits without freeing the previously allocated buffer. The fix reorders the operations so that the unit buffer is only allocated after the IRQ check succeeds, eliminating the leak path. This is a local kernel-level issue triggered during device initialization when a UVC-compatible camera with a privacy GPIO is attached (Feedly, Kernel Git).

The primary impact is a kernel memory leak, which can gradually exhaust kernel memory resources over time if the vulnerable code path is triggered repeatedly (e.g., by repeatedly attaching and detaching a UVC camera device with a privacy GPIO). This affects system availability through potential memory exhaustion but does not directly expose sensitive data or allow arbitrary code execution. There is no known impact on confidentiality or integrity, and lateral movement is not a realistic consequence of this vulnerability (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across multiple stable branches. Fixed versions include Linux kernel 5.15.75, 5.19.17, 6.0.3, and 6.1. Users and administrators should update to a patched kernel version. The specific fix commits are: 6c5da92103bd (6.1 branch), deb8f32ae4b1 (5.19.17 branch), 4a7ae8d982a8 (6.0.3 branch), and f0f078457f18 (5.15.75 branch). No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Kernel Git, ENISA EUVD).