CVE-2022-50882 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix memory leak in uvc_gpio_parse
Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked.
Allocate the unit buffer after the IRQ to avoid it.
Addresses-Coverity-ID: 1474639 ("Resource leak")
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/26/2026
The vulnerability CVE-2022-50882 represents a memory leak issue within the Linux kernel's uvcvideo driver component that specifically affects USB video class devices. This flaw resides in the USB video class (UVC) subsystem which handles video capture devices such as webcams and video cameras. The uvcvideo driver is responsible for managing the communication between USB video devices and the operating system, making it a critical component in multimedia functionality across Linux systems. The vulnerability manifests in the uvc_gpio_parse function where improper resource management leads to memory allocation without subsequent deallocation.
The technical flaw occurs in the sequence of operations within the uvc_gpio_parse function where memory allocation for a unit buffer takes place before the IRQ (interrupt request) validation for privacy GPIO handling. This ordering issue creates a scenario where if the IRQ validation fails or returns an error condition, the previously allocated unit buffer remains in memory without being properly freed. The memory leak directly stems from the lack of proper error handling and resource cleanup in the function execution flow. The vulnerability has been classified as a resource leak by Coverity static analysis tool with ID 1474639, indicating that this represents a classic memory management problem where allocated resources are not properly released upon error conditions.
The operational impact of this vulnerability extends across various Linux distributions that utilize the uvcvideo driver for USB video device support, affecting systems ranging from desktop computers to embedded devices. While the memory leak itself may appear minor in isolation, it can accumulate over time and potentially lead to system performance degradation or resource exhaustion, particularly in systems with high device utilization or long-running processes. The vulnerability affects systems where USB video devices are actively used, especially in environments where privacy GPIO functionality is implemented, which typically controls privacy indicators such as camera lights or lens covers. This could compromise system stability and performance in resource-constrained environments where memory management is critical.
Mitigation strategies for this vulnerability include applying the kernel patch that reorders the memory allocation to occur after the IRQ validation check, ensuring that unit buffer allocation only happens when the privacy GPIO configuration is successfully validated. System administrators should prioritize updating their Linux kernel versions to include the fix, particularly in environments where USB video devices are extensively used. The fix aligns with common security practices for resource management and follows established principles from the CWE (Common Weakness Enumeration) catalog, specifically addressing CWE-401 which covers improper release of memory. Additionally, this vulnerability demonstrates the importance of proper error handling and resource cleanup patterns that align with ATT&CK framework considerations for system stability and reliability. Organizations should implement regular kernel update procedures to ensure all security patches are applied promptly, as this vulnerability could potentially be exploited in scenarios where memory exhaustion leads to system instability or denial of service conditions.