LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50032: usb: renesas: Fix refcount leak bug

In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fix refcount leak bug In usbhs_rza1_hardware_init(), of_find_node_by_name() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2022-50032 is a Linux kernel bug in the Renesas USB driver. It leaks a device-tree reference during hardware initialization. The public record does not provide CVSS, impact details, or active exploitation evidence. Business urgency is mainly for products or appliances running affected Linux kernels with relevant Renesas USB hardware support.

Executive priority

Handle through normal kernel maintenance unless you operate Renesas-based embedded Linux products, where validation should be prioritized. There is no source-backed evidence of active exploitation or broad enterprise impact, but fixed kernels should still be adopted to reduce reliability and support risk.

Technical view

In usbhs_rza1_hardware_init(), of_find_node_by_name() increments a device-tree node reference. The vulnerable code did not release it with of_node_put() after use. The kernel stable fixes add the missing release. The CVE lists Linux kernel affected version entries including 4.16, 4.19.256, 5.4.211, 5.10.138, 5.15.63, 5.19.4, and 6.0.

Likely exposure

Most likely exposure is embedded or specialized Linux systems using the Renesas USBHS/RZ-A1 related kernel driver path. General-purpose Linux servers are less likely to be affected unless they include and use this hardware-specific code. Confirm against vendor kernel builds, because downstream distributions may backport fixes without changing major kernel versions.

Exploitation context

The provided sources describe a refcount leak, not a remote code execution path. There is no KEV listing and no cited evidence of active exploitation. Practical risk appears tied to reliability or resource leakage in systems reaching this driver initialization path, but the public record does not quantify impact.

Researcher notes

Evidence is limited to the CVE description and kernel stable commits. No CVSS, CWE, exploit status, or detailed impact analysis is provided in the bundle. Treat affected-version data carefully because Linux vendors often backport patches; source-level or vendor advisory validation is more reliable than version strings alone.

Mitigation direction

  • Update to a Linux kernel or vendor kernel package containing the referenced stable fixes.
  • For appliances, request confirmation from the vendor that CVE-2022-50032 is fixed or not applicable.
  • Prioritize embedded Renesas-based products before unrelated Linux server fleets.

Validation and detection

  • Inventory systems running Linux kernels in the CVE-listed affected version entries.
  • Check whether the Renesas USBHS/RZ-A1 driver code is present and used.
  • Verify the source includes of_node_put() in usbhs_rza1_hardware_init().
  • Review vendor changelogs for CVE-2022-50032 or the referenced stable commits.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50032 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxaec2927b5944df70bca4bdeea6c4e7c3195dc37a, aec2927b5944df70bca4bdeea6c4e7c3195dc37a, aec2927b5944df70bca4bdeea6c4e7c3195dc37a, aec2927b5944df70bca4bdeea6c4e7c3195dc37a, aec2927b5944df70bca4bdeea6c4e7c3195dc37a, aec2927b5944df70bca4bdeea6c4e7c3195dc37aunaffected
LinuxLinux4.16, 0, 4.19.256, 5.4.211, 5.10.138, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.