CVE-2022-50702

CVE-2022-50702 describes a memory leak vulnerability in the Linux kernel's vdpa_sim module, specifically within the vdpasim_net_init() and vdpasim_blk_init() functions. This occurs when device_register() fails during module probing, leading to the allocated device name not being properly freed due to an un-decremented kobject refcount. The issue is resolved by ensuring put_device() is called to facilitate proper memory cleanup. The severity of this vulnerability is low, as it primarily results in a memory leak rather than direct remote code execution or privilege escalation. There is no CVSS score provided, and its EPSS and FAUCET Risk Score are very low, indicating a minimal threat. The attack vector is local, requiring module loading, and the complexity is moderate given the specific failure condition. There is no evidence of active exploitation, nor are there any known public exploit codes available (Metasploit, Nuclei, ExploitDB). Community discussion and media coverage are non-existent, further suggesting a low level of attention and impact.