LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50392: ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe()

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() The node returned by of_parse_phandle() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the error path in mt8183_mt6358_ts3a227_max98357_dev_probe().

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A Linux kernel bug in a MediaTek MT8183 audio driver can leak a device-tree reference on an error path. The rated impact is local denial of service, not data theft or remote compromise. Exposure is most relevant to systems using the affected kernel and this driver path.

Executive priority

Handle through normal kernel patch management unless affected MT8183-based devices support important operations. Business urgency is moderate because the known impact is availability, requires local privileges, and has no cited active exploitation.

Technical view

The flaw is a reference-count leak in mt8183_mt6358_ts3a227_max98357_dev_probe(). of_parse_phandle() increments a node reference, but the error path failed to call of_node_put(). The kernel stable fixes add the missing cleanup. CVSS 3.1 is 5.5: local, low complexity, low privileges, no user interaction, high availability impact.

Likely exposure

Likely exposed systems are Linux kernels listed as affected in the CVE data, especially where the MediaTek MT8183 ASoC driver is built and used. Systems without this kernel code path or affected versions are less likely exposed.

Exploitation context

The bundle does not show KEV listing, public exploitation, exploit code, or a remote attack vector. The CVSS vector indicates local access with low privileges and an availability-only impact. Treat exploitation evidence as limited.

Researcher notes

Evidence is concise and kernel-source focused. No CWE, proof of exploitation, detailed trigger path, or vendor-specific affected product list is provided. Avoid broad exposure claims beyond affected Linux kernels and the MT8183 driver context.

Mitigation direction

  • Update to a kernel version containing the referenced stable fixes.
  • Check distribution or device-vendor advisories for packaged kernel updates.
  • Prioritize devices using the MediaTek MT8183 ASoC audio driver.
  • If updates are unavailable, follow vendor guidance for temporary risk reduction.

Validation and detection

  • Inventory Linux kernel versions against the affected version ranges in the CVE data.
  • Confirm whether the MT8183 ASoC driver is present and enabled.
  • Verify kernel source or package changelogs include the referenced stable commits.
  • Confirm deployed kernels after patching, not only available package versions.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50392 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2022-50392Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux11c0269017b212fd47c593307d2dc3eb9713b2d0, 11c0269017b212fd47c593307d2dc3eb9713b2d0, 11c0269017b212fd47c593307d2dc3eb9713b2d0, 11c0269017b212fd47c593307d2dc3eb9713b2d0unaffected
LinuxLinux5.2, 0, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.