CVE-2022-50857 rapidio: rio: fix possible name leak in rio_register_mport()
A memory leak in the Linux kernel RapidIO subsystem allows local attackers to potentially read sensitive kernel memory or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50857?
CVE-2022-50857 is a memory corruption vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rapidio: rio: fix possible name leak in rio_register_mport()
If device_register() returns error, the name allocated by dev_set_name() need be freed. It should use put_device() to give up the reference in the error path, so that the name can be freed in kobject_cleanup(), and list_del() is called to delete the port from rio_mports.
Which versions are affected by CVE-2022-50857?
How do I fix CVE-2022-50857?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50857 being exploited?
There is no known exploitation of CVE-2022-50857 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50857, GHSA-mmh4-m2wj-3q4g, UBUNTU-CVE-2022-50857.