Security readout for executives and security teams
Plain-English summary
CVE-2022-50663 is a Linux kernel memory-leak fix in the stmmac network driver. If driver initialization fails at a specific workqueue creation point, allocated memory may not be freed. Public sources do not provide a CVSS score, real-world exploitation evidence, or a broad impact assessment.
Executive priority
Treat as routine kernel hygiene unless your environment relies heavily on affected stmmac network driver deployments. No public evidence in the provided sources indicates active exploitation or critical business urgency.
Technical view
The issue is in stmmac_dvr_probe(). When create_singlethread_workqueue() fails, priv->af_xdp_zc_qps was not released with bitmap_free(), causing a memory leak. Kernel stable commits add an error path to free the bitmap. The CVE record lists affected Linux kernel ranges and fix references, but no CWE or CVSS.
Likely exposure
Likely limited to systems running affected Linux kernel builds where the stmmac driver is present and reaches this probe failure path. Exposure should be assessed by kernel version, downstream vendor backports, and whether the relevant stable fix is included.
Exploitation context
The source bundle does not show active exploitation, KEV listing, exploit availability, or remote attack details. The described condition is an initialization failure path, suggesting operational reliability risk rather than clearly demonstrated attacker-driven compromise.
Researcher notes
Evidence is narrow: a kernel memory leak in an error path with no CVSS, CWE, or exploit discussion in the supplied sources. Validate using commit presence rather than version alone because Linux distributions often backport fixes.
Mitigation direction
- Update to a kernel or vendor package containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes to supported kernels.
- Prioritize systems using affected kernels and stmmac-supported networking hardware.
Validation and detection
- Inventory Linux kernel versions across affected assets.
- Confirm whether referenced stable commits are present or backported.
- Review vendor kernel changelogs for CVE-2022-50663 or the stmmac fix.
- Check whether stmmac is built, loaded, or used on target systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50663 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/96e50897029f65222ef76cfe9bc802321fcea33bCVE reference
- https://git.kernel.org/stable/c/b59253e32c203a20bce15dca80890b7d268bacd7CVE reference
- https://git.kernel.org/stable/c/446757787baf99b7db15cb347783c45a37bfe21fCVE reference
- https://git.kernel.org/stable/c/a137f3f27f9290933fe7e40e6dc8a445781c31a2CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.