CVE-2022-50848

Root

Cause In dio_init(), if device_register() returns an error, the allocated dev and its name are not freed, resulting in a memory leak. The fix adds a release function and calls put_device() in the error path to properly release resources.

Exploitation

This vulnerability is local in nature and exploitable only if a device registration failure occurs during DIO bus initialization. An attacker with local access or ability to influence hardware configuration could potentially trigger the failure condition, causing repeated leaks.

Impact

The memory leak gradually exhausts kernel memory, which can lead to system instability, denial of service, or resource exhaustion. No privilege escalation or code execution is reported.

Mitigation

The issue has been patched in stable kernel releases, as seen in commit [1]. Users should update their kernels to include the fix.