Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory leak in the AMD GPU compute driver path. Under a specific error condition, kernel memory may not be freed. The likely business impact is availability risk on affected systems, not confirmed data theft or privilege escalation. Public data does not show active exploitation.
Executive priority
Handle in normal kernel patch cycles, with higher priority for AMD GPU compute servers, shared research systems, and workloads sensitive to availability. There is no sourced evidence of active exploitation or data compromise, but unpatched memory leaks can contribute to service degradation.
Technical view
In drm/amdkfd, kfd_mem_dmamap_userptr() allocated an SG table before confirming page-count consistency between userptr BO and SG BO. If the counts differed, the function returned -EINVAL without freeing that allocation. The kernel fix checks page count before SG table allocation.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with the amdkfd AMD GPU compute driver in use. The CVE data lists Linux kernel versions/ranges but does not provide distribution-specific package status. Systems without this driver path are less likely to be exposed.
Exploitation context
The sources describe a memory leak in an error path. They do not state remote exploitability, privilege escalation, public exploit availability, or active exploitation. CISA KEV status is false in the provided bundle, so treat this as a patch-validation and availability-risk item.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit status, or distro-specific fixed package data is provided. The affected-version data appears kernel-focused, so validate against actual vendor kernel builds and backports rather than upstream version numbers alone.
Mitigation direction
- Check Linux distribution advisories for CVE-2022-50619 coverage.
- Upgrade to a kernel package that includes the referenced stable fixes.
- Prioritize AMD GPU compute hosts and shared multi-user Linux systems.
- If patching is delayed, review vendor guidance for safe workarounds.
Validation and detection
- Inventory Linux kernel versions across relevant systems.
- Identify hosts using AMD GPU compute or the amdkfd driver path.
- Confirm the running kernel includes the upstream stable fix commits.
- Review distro security trackers for backported fix status.
- Monitor affected hosts for unusual kernel memory pressure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50619 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.