CVE-2022-50561

In the Linux kernel, a memory leak vulnerability exists in the Industrial I/O (IIO) subsystem's event registration function iio_device_register_eventset(). When iio_device_register_sysfs_group() fails, the allocated attrs array is not freed, leading to a memory leak that can be detected by kmemleak [1][2].

Exploitation requires triggering a failure in the sysfs group registration during IIO device initialization. This can occur under specific conditions where the device probing encounters an error, possibly due to resource constraints or misconfiguration. No special privileges are needed beyond the ability to probe the IIO device [1].

The impact is a persistent memory leak that can exhaust system memory over time, leading to denial of service. The kernel kmemleak utility reports unreferenced objects of size 32 bytes from this code path [1].

Patches have been applied to stable kernel branches as referenced [1][2]. Users should update their kernels to include these fixes. No workaround is documented.