CVE-2022-50547 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2022-50547?

CVE-2022-50547 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's solo6x10 media driver. If device_register() fails during solo_sysfs_init(), the allocated device name isn't properly freed, leading to kernel memory exhaustion over time. This affects systems using the solo6x10 driver for video capture cards.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's solo6x10 media driver. If device_register() fails during solo_sysfs_init(), the allocated device name isn't properly freed, leading to kernel memory exhaustion over time. This affects systems using the solo6x10 driver for video capture cards.

💻 Affected Systems

Products:

Linux kernel with solo6x10 driver enabled

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if CONFIG_VIDEO_SOLO6X10 is enabled and solo6x10 hardware is present/used.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could cause kernel memory exhaustion leading to system instability, crashes, or denial of service requiring reboot.

🟠

Likely Case

Memory leak gradually consumes kernel memory, potentially causing performance degradation or system instability over extended periods.

🟢

If Mitigated

With proper kernel memory monitoring and restart policies, impact is limited to occasional service interruptions.

🌐 Internet-Facing: LOW - Requires local access to trigger the vulnerable code path.

🏢 Internal Only: MEDIUM - Systems with solo6x10 hardware could experience stability issues affecting video capture functionality.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires triggering device_register() failure in solo_sysfs_init(), which needs specific conditions and local access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 49060c0da57a, 7b02c50d3978, 7cf71bbe5d2e, 7f5866dd96d9, 83d4b1ae98a4

Vendor Advisory: https://git.kernel.org/stable/c/49060c0da57a381563e482e331dc9d4c3725b41b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check distribution-specific security advisories. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable solo6x10 module

linux

Prevent loading of vulnerable driver if not needed

echo 'blacklist solo6x10' >> /etc/modprobe.d/blacklist.conf
rmmod solo6x10

🧯 If You Can't Patch

Monitor kernel memory usage for abnormal increases
Implement system restart policies if memory exhaustion occurs

🔍 How to Verify

Check if Vulnerable:

Check if solo6x10 module is loaded: lsmod | grep solo6x10 AND check kernel version against distribution security advisories

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: grep -q '49060c0da57a\|7b02c50d3978\|7cf71bbe5d2e\|7f5866dd96d9\|83d4b1ae98a4' /proc/version_signature

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
System instability logs
Memory exhaustion warnings in dmesg

Network Indicators:

None - local vulnerability

SIEM Query:

source="kernel" AND ("Out of memory" OR "oom-killer" OR "solo6x10")

📊 Metadata

CVE ID: CVE-2022-50547

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: October 7, 2025

Last Updated: February 5, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50547, you might also want to check these: