CVE-2022-50759

Vulnerability

Overview

The vulnerability is a memory leak in the Linux kernel's OV5648 camera sensor driver (media: i2c: ov5648). The V4L2 fwnode data structure, which is allocated during driver probe, is not freed when the driver is unbound from the device. This leads to a kernel memory leak, as the allocated memory is never released [1].

Exploitation and

Impact

To exploit this, an attacker would need the ability to repeatedly bind and unbind the OV5648 driver, which typically requires root privileges or access to driver sysfs interfaces. Each unbind operation leaks a small amount of kernel memory. Over time, repeated operations could exhaust kernel memory, potentially leading to denial of service (system instability or crash). No authentication from a remote network is required; the attack is local.

Mitigation

The fix is included in the Linux kernel stable tree as commit referenced [1]. Users should update to a kernel version containing this commit. No workaround is mentioned in the source.