LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50544: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()

In the Linux kernel, the following vulnerability has been resolved: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() xhci_alloc_stream_info() allocates stream context array for stream_info ->stream_ctx_array with xhci_alloc_stream_ctx(). When some error occurs, stream_info->stream_ctx_array is not released, which will lead to a memory leak. We can fix it by releasing the stream_info->stream_ctx_array with xhci_free_stream_ctx() on the error path to avoid the potential memory leak.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A bug in the Linux kernel's USB 3.0 (xHCI) host driver could leak memory when setting up streaming USB endpoints fails. Over time this wastes kernel memory and can degrade or destabilize systems that handle many USB streaming devices. The Linux maintainers fixed it; updating to a patched kernel resolves the issue.

Executive priority

Low priority. This is a stability/memory-hygiene fix in the Linux USB 3.0 driver with no known exploitation and no remote attack vector. Roll it in with routine kernel maintenance; no emergency action required.

Technical view

In drivers/usb/host/xhci-mem.c, xhci_alloc_stream_info() allocated stream_ctx_array via xhci_alloc_stream_ctx() but did not free it on error paths, producing a memory leak. The fix releases stream_ctx_array with xhci_free_stream_ctx() when subsequent allocations fail. Affected lines exist from kernel 2.6.35 onward; fixes are in 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1.

Likely exposure

Any Linux system using xHCI (USB 3.x) host controllers with stream-capable USB devices (e.g., UAS/USB Attached SCSI storage). Practical exposure requires repeated allocation failures during stream setup, which is uncommon outside fault-injection or memory-pressure scenarios. Embedded, server, and desktop kernels prior to the fix points are technically affected.

Exploitation context

No KEV listing and no public exploitation reported in the bundled sources. The defect is a kernel memory leak on an error path, not a remotely reachable vulnerability, and no CVSS score is provided. Triggering the leak requires local conditions that cause stream context allocation to fail repeatedly.

Researcher notes

Resource leak on a failure path in xhci_alloc_stream_info(); no CWE assigned in the bundle and no CVSS provided. Affected versions list is broad due to the long-lived allocation pattern dating to 2.6.35. Multiple stable-tree backports landed simultaneously, indicating a coordinated maintainer fix rather than active abuse. No exploit primitives are evident from the description.

Mitigation direction

  • Upgrade Linux kernels to 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, or 6.1+.
  • Apply the distribution vendor's stable kernel update once it incorporates the upstream fix commits.
  • On long-running hosts with USB streaming workloads, schedule reboots after kernel updates to clear leaked memory.
  • Track downstream backports via your distro's CVE tracker until patched packages are deployed.

Validation and detection

  • Compare running kernel version (uname -r) against the listed fixed releases for your branch.
  • Confirm the fix commit is present in your kernel source or vendor changelog (see git.kernel.org references).
  • Review distribution security advisories for CVE-2022-50544 to verify package-level remediation.
  • Monitor kernel slab/memory metrics on USB-heavy hosts to detect residual growth before patching.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50544 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1, 8df75f42f8e67e2851cdcf6da91640fb881defd1unaffected
LinuxLinux2.6.35, 0, 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.