CVE-2022-50275 in Linux
Summary
by MITRE • 09/15/2025
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: Add the missed acpi_put_table() to fix memory leak
When the radeon driver reads the bios information from ACPI table in radeon_acpi_vfct_bios(), it misses to call acpi_put_table() to release the ACPI memory after the init, so add acpi_put_table() properly to fix the memory leak.
v2: fix text formatting (Alex)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/10/2026
The vulnerability identified as CVE-2022-50275 represents a memory leak within the Linux kernel's radeon graphics driver component that specifically affects systems utilizing advanced configuration and power interface tables for graphics firmware information. This issue resides in the direct rendering manager subsystem of the Linux kernel, which handles graphics hardware management and driver interactions for AMD Radeon graphics cards. The flaw manifests when the radeon driver attempts to extract BIOS information from ACPI tables during system initialization, creating a scenario where allocated memory resources are not properly released back to the system.
The technical root cause of this vulnerability stems from the radeon_acpi_vfct_bios() function implementation within the graphics driver code. During the initialization process, the driver successfully retrieves the required BIOS information from ACPI tables through appropriate kernel APIs, but fails to invoke the acpi_put_table() function to properly release the memory mapping that was acquired during the table access operation. This memory management oversight creates a persistent memory leak that accumulates over time and can potentially lead to system resource exhaustion, particularly in environments where graphics drivers are frequently initialized or reinitialized. The vulnerability specifically aligns with CWE-401, which categorizes memory leaks as a common software weakness that can result in resource exhaustion and system instability.
The operational impact of this memory leak vulnerability extends beyond simple resource consumption, as it can potentially affect system performance and stability over extended periods of operation. Systems running graphics-intensive applications or those with frequent driver reloads may experience progressive memory degradation, leading to reduced system responsiveness, potential application crashes, or in severe cases, system instability. The vulnerability affects all Linux systems utilizing AMD Radeon graphics hardware that rely on ACPI table information for BIOS retrieval during driver initialization, making it a widespread concern for graphics driver users across various Linux distributions. Security researchers have noted that while this vulnerability does not directly enable arbitrary code execution or privilege escalation, it creates conditions that could be exploited in combination with other vulnerabilities to amplify system instability or resource exhaustion attacks.
Mitigation strategies for CVE-2022-50275 primarily involve applying the kernel patch that correctly implements the acpi_put_table() call within the radeon driver's initialization sequence. System administrators should ensure their Linux systems are updated with the patched kernel version that includes the fix, which typically involves upgrading to a kernel version that contains the corrected radeon driver implementation. The fix represents a straightforward memory management correction that aligns with the ATT&CK framework's defensive measures for system hardening, specifically addressing the maintenance of system resources and preventing resource exhaustion conditions. Organizations should prioritize updating their kernel versions to include this patch, particularly in production environments where graphics driver stability and system resource management are critical. Additionally, monitoring system memory usage and implementing automated patch management systems can help prevent exploitation of similar memory-related vulnerabilities that may exist in other kernel subsystems. The fix demonstrates the importance of proper resource management in kernel drivers and reinforces the principle that all allocated resources must be properly released to maintain system stability and prevent potential denial of service conditions.