Security readout for executives and security teams
Plain-English summary
This Linux kernel issue is a memory leak in the hpsa storage controller driver during a failed initialization path. It is not listed as actively exploited, and the published severity is unknown. Business urgency is mainly for Linux systems using affected kernels, especially where hpsa-supported storage controllers are present.
Executive priority
Treat as routine kernel maintenance unless you operate critical Linux servers using hpsa storage controllers. No active exploitation is cited, but kernel memory leaks can reduce reliability. Patch through standard update cycles, prioritizing storage-heavy or highly available systems.
Technical view
In hpsa_init_one(), hpda_alloc_ctlr_info() allocates controller state and reply_map. If alloc_percpu() fails, the error path frees only the controller object, leaking reply_map. The fix changes cleanup to use hpda_free_ctlr_info(), releasing both allocations. The CVE record lists affected Linux kernel versions and multiple stable kernel commits.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the hpsa SCSI driver relevant to supported storage hardware. Systems without that driver or hardware are less likely to encounter the vulnerable path. Distro backports may change exposure despite upstream version numbers.
Exploitation context
No KEV listing or source-bundle evidence indicates active exploitation. The bug is in an allocation-failure error path during driver initialization, suggesting a narrow denial-of-service/resource-exhaustion concern rather than direct data compromise. Practical exploitability is not established in the provided sources.
Researcher notes
The CVE metadata lacks CVSS, CWE, and exploit details. The affected-version data is terse, so validation should rely on exact upstream commits or distribution backport advisories. The core defect is cleanup mismatch after alloc_percpu() failure in hpsa_init_one().
Mitigation direction
- Apply vendor or distribution kernel updates containing the hpsa cleanup fix.
- Prioritize systems using hpsa-supported storage controllers.
- Reboot into the updated kernel after patching, if required by your platform.
- If update availability is unclear, check your Linux vendor’s advisory and backport status.
Validation and detection
- Inventory Linux kernel versions across affected server fleets.
- Identify systems where the hpsa driver is present or in use.
- Confirm installed kernels include the referenced stable hpsa fix or vendor backport.
- Track remediation through normal kernel patch compliance reporting.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50646 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f4d1c14e8b404766ff2bb8644bb19443d73965deCVE reference
- https://git.kernel.org/stable/c/f8fc2f18652917cdcc89cb23f3a1b7cb6e119c5eCVE reference
- https://git.kernel.org/stable/c/c808edbf580bfc454671cbe66e9d7c2e938e7601CVE reference
- https://git.kernel.org/stable/c/bfe10a1d9fbccdf39f8449d62509f070d8aaaac1CVE reference
- https://git.kernel.org/stable/c/fc998d0a7d65672f0812f11cd0ec4bbe4f8f8507CVE reference
- https://git.kernel.org/stable/c/0aa7be66168b1e84b2581ffff3ccb54a6c804a1eCVE reference
- https://git.kernel.org/stable/c/9c9ff300e0de07475796495d86f449340d454a0cCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.