LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50121: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init

In the Linux kernel, the following vulnerability has been resolved: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node. When breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node. Add missing of_node_put() to avoid refcount leak.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel resource-management bug in the k3-r5 remote processor driver. The kernel failed to release a device-tree node reference when exiting a loop early, causing a reference-count leak. The sources do not provide CVSS, CWE, impact details, or evidence of active exploitation.

Executive priority

Treat this as a targeted kernel maintenance item, not an emergency, unless critical Linux devices use the k3-r5 remoteproc driver. Prioritize confirmation and routine patching because severity and exploitability are not established in the provided sources.

Technical view

CVE-2022-50121 fixes a missing of_node_put() in k3_r5_cluster_of_init(). When for_each_available_child_of_node() breaks early, the current child node must be released explicitly. The issue affects listed Linux kernel versions and is addressed through Linux stable commits referenced by the CVE record.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the remoteproc k3-r5 driver present or in use. The source bundle provides no CPEs, distribution advisories, or hardware inventory mapping, so affected estate identification requires local kernel and vendor package review.

Exploitation context

The CVE is not marked KEV, and the provided sources do not claim active exploitation or public exploit availability. The documented flaw is a kernel reference-count leak; the sources do not state whether it enables denial of service, privilege escalation, or another direct security outcome.

Researcher notes

The useful technical signal is narrow: missing of_node_put() after early loop exit in k3_r5_cluster_of_init(). The source bundle lacks CVSS, CWE, impact analysis, exploit evidence, and distro-specific fixed package data. Avoid broad claims beyond the Linux kernel component and listed versions.

Mitigation direction

  • Check Linux vendor or distribution guidance for CVE-2022-50121 applicability.
  • Update affected kernels to builds containing the referenced stable fixes.
  • Prioritize embedded or SoC platforms using the k3-r5 remoteproc driver.
  • Track distro backports rather than relying only on upstream version numbers.

Validation and detection

  • Inventory Linux kernel versions against the affected versions in the CVE record.
  • Determine whether the k3-r5 remoteproc driver is built, loaded, or used.
  • Confirm patched kernels include one of the referenced upstream stable commits.
  • Document systems where vendor guidance says the issue is not applicable.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50121 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6dedbd1d544389d6ab1727423348572a11e9df5d, 6dedbd1d544389d6ab1727423348572a11e9df5d, 6dedbd1d544389d6ab1727423348572a11e9df5d, 6dedbd1d544389d6ab1727423348572a11e9df5d, 6dedbd1d544389d6ab1727423348572a11e9df5dunaffected
LinuxLinux5.10, 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.