LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50882: media: uvcvideo: Fix memory leak in uvc_gpio_parse

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix memory leak in uvc_gpio_parse Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate the unit buffer after the IRQ to avoid it. Addresses-Coverity-ID: 1474639 ("Resource leak")

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2022-50882 is a Linux kernel bug in the UVC camera driver. An error path could leak a small kernel memory allocation while parsing a privacy GPIO interrupt. The public record does not show active exploitation or a severity score. Business urgency is generally low unless you run affected Linux kernels on systems using this camera driver path.

Executive priority

Treat as routine kernel maintenance unless your fleet heavily depends on affected Linux camera functionality. There is no cited active exploitation and no CVSS score in the provided sources. Patch through normal OS update processes and validate affected device classes.

Technical view

The uvcvideo driver allocated a unit buffer before validating the privacy GPIO IRQ. If IRQ handling returned an error, that buffer was not freed. The kernel fix moves allocation until after the IRQ check. The source identifies this as a Coverity resource leak in uvc_gpio_parse, with stable kernel fixes referenced.

Likely exposure

Exposure appears limited to Linux systems with affected kernel versions and the uvcvideo driver exercising the privacy GPIO parsing path. Systems without this driver or relevant camera hardware path are less likely to be exposed. Version impact should be confirmed against the CVE record and kernel stable commits.

Exploitation context

The provided sources do not report exploitation, exploit availability, or KEV listing. The issue is described as a memory leak on an error path, not as code execution or privilege escalation. Practical impact may be limited, but repeated triggering could potentially contribute to resource exhaustion; the sources do not quantify this.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. The affected-version data in the bundle is not fully normalized, so confirm exact introduced and fixed ranges from upstream or distribution advisories. Avoid assuming broader impact beyond the uvcvideo privacy GPIO parsing error path.

Mitigation direction

  • Check your Linux distribution or kernel vendor advisory for the fixed kernel package.
  • Prioritize kernels matching the affected ranges in the CVE record.
  • Update to a kernel containing the referenced uvcvideo stable fixes.
  • If updates are delayed, assess whether uvcvideo is required on exposed systems.

Validation and detection

  • Inventory Linux kernel versions across laptops, workstations, servers, and appliances.
  • Identify systems using the uvcvideo driver or camera privacy GPIO functionality.
  • Compare installed kernels with vendor fixed versions and upstream stable commits.
  • Confirm remediation by verifying the running kernel includes the uvc_gpio_parse fix.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50882 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28, 2886477ff98740cc3333cf785e4de0b1ff3d7a28unaffected
LinuxLinux5.12, 0, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.