Security readout for executives and security teams
Plain-English summary
CVE-2022-50395 is a Linux kernel memory leak in the integrity keyring setup path. A local low-privileged user could contribute to availability impact if the vulnerable error path is repeatedly triggered. The source bundle does not indicate data theft, integrity compromise, remote exploitation, or active exploitation.
Executive priority
Treat as routine but real availability risk. Patch through normal kernel maintenance, faster on shared or multi-tenant Linux systems. There is no source-backed evidence here requiring emergency incident response.
Technical view
The flaw is CWE-401 in integrity_init_keyring(): a key restriction allocation is not freed when keyring allocation fails. CVSS 3.1 is 5.5, local attack vector, low complexity, low privileges, no user interaction, and high availability impact only.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or vendor builds carrying the vulnerable integrity keyring code before the referenced stable fixes. Internet-facing status alone is not a strong indicator because the vector is local.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation. Exploitation requires local access with low privileges and depends on reaching a specific allocation-failure path, so this is primarily a local denial-of-service concern.
Researcher notes
Focus analysis on the Linux integrity subsystem keyring allocation error path. The source bundle establishes the bug class, affected Linux scope, CVSS vector, and fix commits, but does not provide operational exploit details or exploitation-in-the-wild evidence.
Mitigation direction
- Identify Linux kernel versions across servers, endpoints, containers hosts, and appliances.
- Apply vendor kernel updates that include the referenced stable Linux fixes.
- Prioritize multi-user systems and hosts allowing untrusted local shell access.
- Check distribution advisories for backported fixes before relying on upstream version numbers.
- Monitor kernel memory pressure and abnormal local-user activity until patched.
Validation and detection
- Compare running kernel builds against the CVE affected versions and vendor advisories.
- Confirm the relevant stable fix commit is present or backported by the vendor.
- Review asset inventory for Linux hosts with untrusted local user access.
- Verify patch deployment through package metadata or kernel changelog evidence.
- Do not attempt exploit reproduction on production systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50395 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9b7c44885a07c5ee7f9bf3aa3c9c72fb110c8d22CVE reference
- https://git.kernel.org/stable/c/3bd737289c26be3cee4b9afaf61ef784a2af9d6eCVE reference
- https://git.kernel.org/stable/c/29d6c69ba4b96a1de0376e44e5f8b38b13ec8803CVE reference
- https://git.kernel.org/stable/c/57e49ad12f8f5df0c48e1710c54b147a05a10c32CVE reference
- https://git.kernel.org/stable/c/c591c48842f08d30ec6b8416757831985ed9a315CVE reference
- https://git.kernel.org/stable/c/39419ef7af0916cc3620ecf1ed42d29659109bf3CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.