CVE-2022-50658

Vulnerability

The vulnerability is a memory leak in the cpufreq driver for Qualcomm (QCOM) platforms in the Linux kernel. When the driver detects an incorrect speedbin length during initialization, the error handling path does not free the allocated speedbin buffer, causing the memory to be leaked [1].

Exploitation

An attacker would need to be able to influence the speedbin length read from firmware or device tree, potentially through a malicious firmware update or by exploiting another vulnerability to corrupt the configuration data. No authentication is required beyond normal system access that can trigger driver initialization [2].

Impact

Repeated triggering of the error path can exhaust kernel memory, leading to a denial of service. The impact is limited to memory depletion; there is no immediate remote code execution or privilege escalation.

Mitigation

The issue is fixed in the Linux kernel by ensuring the speedbin buffer is freed in the error path. Patches have been applied to stable kernel branches [1][2]. Users should update their kernels to include the fix.