LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50017: mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start

In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start We should call of_node_put() for the reference 'uctl_node' returned by of_get_parent() which will increase the refcount. Otherwise, there will be a refcount leak bug.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in a Cavium Octeon MIPS USB clock path. The documented issue is a missing reference release that can leak kernel references. The source bundle does not provide CVSS, a CWE, active exploitation evidence, or a business-impact scenario.

Executive priority

Treat this as a low-priority hygiene item unless your environment includes Cavium Octeon MIPS appliances or custom kernels. There is no cited active exploitation, but embedded kernel fixes can lag and should be tracked through normal maintenance.

Technical view

octeon2_usb_clocks_start obtains a device-tree parent reference through of_get_parent but did not call of_node_put for uctl_node. The Linux fix releases that reference to prevent a refcount leak. Scope appears limited to Linux MIPS Cavium Octeon code paths.

Likely exposure

Exposure is likely limited to systems running affected Linux kernel versions on MIPS Cavium Octeon hardware using the relevant USB clock initialization path. General Linux servers on other architectures are not indicated as affected by the supplied sources.

Exploitation context

No active exploitation is supported by the provided sources. The CVE is not marked KEV, and the bundle contains no public exploit report, exploitability analysis, or remote attack path.

Researcher notes

The available evidence identifies a refcount leak fix, not a demonstrated privilege escalation or remote exploit. Affected-version data in the bundle is broad and should be reconciled against exact stable commits and downstream vendor backports.

Mitigation direction

  • Review vendor kernel advisories for affected distribution packages and supported fixed builds.
  • Apply Linux stable updates containing the referenced kernel fixes when available for your platform.
  • Prioritize embedded, appliance, or network devices using Cavium Octeon MIPS kernels.
  • Track unsupported custom kernels separately and backport the of_node_put fix if needed.

Validation and detection

  • Inventory Linux devices by architecture, kernel version, and Cavium Octeon hardware usage.
  • Check whether kernel source includes the octeon2_usb_clocks_start of_node_put fix.
  • Map deployed kernels against vendor advisories or the referenced stable commits.
  • Confirm no unsupported custom kernel remains on the affected code path.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50017 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70, a95cfa6b86a19a822877e75d5a73b2a95d249e70unaffected
LinuxLinux4.0, 0, 4.9.326, 4.14.291, 4.19.256, 5.4.211, 5.10.138, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.