CVE-2022-50522

3.3 LOW
Denial of Service

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's mcb-parse module. When mcb_device_register() fails in the chameleon_parse_gdd() function, reference counts for bus and device name objects aren't properly released, leading to resource exhaustion over time. This affects Linux systems with the mcb-parse module loaded.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Kernel versions with the vulnerable mcb-parse module (specific version range not specified in CVE, but patches exist for stable branches)
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ✅ No
Notes: Only vulnerable if the mcb-parse module is loaded. This module is typically used for MCB (Memory Controller Bus) hardware support and may not be loaded by default on most systems.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or potential kernel panic.

🟠

Likely Case

Gradual memory leak leading to degraded system performance over time, potentially requiring system reboot to recover resources.

🟢

If Mitigated

Minimal impact with proper monitoring and resource limits in place.

🌐 Internet-Facing: LOW - Requires local access or kernel module loading capability.
🏢 Internal Only: MEDIUM - Could be exploited by malicious local users or through other vulnerabilities to degrade system stability.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires ability to trigger the error condition in chameleon_parse_gdd(), which typically requires specific hardware or kernel module interactions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches (see references for specific commits)

Vendor Advisory: https://git.kernel.org/stable/c/728ac3389296caf68638628c987aeae6c8851e2d

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution vendor. 2. Reboot the system to load the new kernel. 3. Verify the fix by checking kernel version.

🔧 Temporary Workarounds

Unload mcb-parse module

linux

Remove the vulnerable module if not required for system functionality

sudo rmmod mcb-parse

Blacklist module loading

linux

Prevent the module from being loaded automatically

echo 'blacklist mcb-parse' | sudo tee /etc/modprobe.d/blacklist-mcb-parse.conf

🧯 If You Can't Patch

  • Monitor system memory usage for unusual increases
  • Implement kernel module loading restrictions to prevent exploitation

🔍 How to Verify

Check if Vulnerable:

Check if mcb-parse module is loaded: lsmod | grep mcb-parse

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions from your distribution vendor

📡 Detection & Monitoring

Log Indicators:

  • Kernel oops messages
  • Memory allocation failures in kernel logs
  • System instability logs

Network Indicators:

  • None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("mcb-parse" OR "chameleon_parse_gdd" OR "mcb_device_register")

📊 Metadata

CVE ID: CVE-2022-50522
CVSS v3 Score: 3.3 (LOW)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: October 7, 2025
Last Updated: February 5, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON