CVE-2022-50836

What it actually does

The vulnerability is a memory leak in the qcom_add_sysmon_subdev function of the Linux kernel's remoteproc sysmon subsystem, where allocated memory is not freed when of_irq_get_byname or devm_request_threaded_irq fails.

Why it matters to the business

Over time, repeated triggering of the error conditions can lead to gradual memory exhaustion, potentially causing system instability or denial of service on affected devices; low prevalence and no known exploitation reduce immediate risk but patching remains important for long-term stability.

How an attack unfolds

An attacker would need to trigger specific error conditions during sysmon subdevice initialization on a Qualcomm-based Linux system; the flaw is not known to be exploited by any threat actors and has negligible EPSS with no ransomware or KEV association.

How to fix it

Upgrade affected systems to fixed versions including commit 27441fab2651cd909d8a5440ca079bc50245f427 in the Linux kernel GIT repository or Wireshark 2.6.5-1 on Debian 11-14.

How to confirm the fix worked

Inspect the qcom_add_sysmon_subdev source for added kfree calls on error paths or confirm the running kernel matches a fixed commit or package version.

Typical attack path

1. Locate a vulnerable Linux kernel instance with the affected remoteproc sysmon code
2. Force error paths in of_irq_get_byname or devm_request_threaded_irq during qcom_add_sysmon_subdev execution
3. Repeat to accumulate leaked memory and observe resource depletion

How to detect it

Review kernel boot and device probe logs for failures around sysmon IRQ setup and correlate with gradual increases in kernel memory usage over time.

What your security team should do

• Prioritize applying the listed kernel or package updates on all affected systems
• Review Qualcomm-based device initialization logs for recurring errors that could trigger the leak
• Monitor overall memory usage trends on systems running vulnerable kernels