CVE-2022-50557

Vulnerability

CVE-2022-50557 describes a memory leak in the Linux kernel's pinctrl driver for ThunderBay. The function thunderbay_build_functions() allocates memory for thunderbay_funcs but fails to free it when thunderbay_add_functions() encounters an error. This missing kfree() leads to a memory leak.

Exploitation

An attacker who can trigger a failure in thunderbay_add_functions()—for example, by causing memory pressure or invalid inputs—can cause the allocated memory to remain unreleased. Since the driver runs in kernel space, repeated exploitation can exhaust system memory, leading to denial of service.

Impact

Successful exploitation results in a memory leak that can degrade system performance or cause a crash due to memory exhaustion. No privilege escalation or code execution is involved; the impact is limited to availability.

Mitigation

The issue was fixed in the Linux kernel stable commit [1], which moved the cleanup code to properly free memory on error paths. Users should apply the kernel update to address the vulnerability.