CVE-2022-50723 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fix memory leak in bnxt_nvm_test()
Free the kzalloc'ed buffer before returning in the success path.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-50723 represents a memory leak condition within the Linux kernel's bnxt_en driver, which is responsible for managing Broadcom network adapters. This issue specifically affects the bnxt_nvm_test() function where improper memory management leads to resource exhaustion over time. The vulnerability resides in the driver's handling of allocated memory during successful execution paths, creating a scenario where allocated kernel memory is not properly released back to the system. Such memory leaks can accumulate and eventually degrade system performance or lead to system instability, particularly in environments where network adapter testing occurs frequently.
The technical flaw manifests in the bnxt_nvm_test() function where a buffer is allocated using kzalloc, a kernel memory allocation function that initializes memory to zero. The vulnerability occurs because the allocated memory buffer is not freed before the function returns successfully, creating a classic memory leak pattern. This type of issue falls under CWE-401: Improper Release of Memory and is particularly concerning in kernel space where memory management is critical for system stability. The problem is exacerbated by the fact that the leak occurs in a function that may be called repeatedly during system operations or testing procedures, amplifying its impact over time.
The operational impact of this vulnerability extends beyond simple memory consumption issues as it can lead to progressive system degradation and potential denial of service conditions. When the bnxt_en driver is actively used in network-intensive environments or during routine testing operations, the accumulated memory leaks can consume significant portions of available kernel memory. This can result in system slowdowns, increased swap usage, and potentially complete system crashes when memory resources become exhausted. The vulnerability affects systems running Linux kernels with the affected bnxt_en driver, particularly those utilizing Broadcom network hardware, making it relevant to enterprise networking environments and data centers where such hardware is prevalent.
Mitigation strategies for CVE-2022-50723 involve applying the appropriate kernel security patches that implement proper memory deallocation before function return. System administrators should prioritize updating their Linux kernel versions to include the fix for this vulnerability, which typically involves ensuring the kzalloc'ed buffer is freed before returning in the success path of the bnxt_nvm_test() function. Organizations should also implement monitoring solutions to detect memory usage patterns that might indicate memory leak accumulation, though the primary defense remains the application of the vendor-provided security update. This vulnerability aligns with ATT&CK technique T1490: Inhibit System Recovery, as memory leaks can contribute to system instability and reduced availability. The fix demonstrates proper kernel memory management practices that align with secure coding standards and represents a fundamental requirement for maintaining kernel stability and preventing resource exhaustion attacks.