Security readout for executives and security teams
Plain-English summary
A small bug in a Linux kernel routine for older Texas Instruments OMAP4 ARM boards left a device-tree node reference uncounted, slowly leaking memory. It does not allow attackers in, does not steal data, and only matters on systems running this specific ARM hardware support code. The fix is a one-line cleanup that has been merged into stable kernels.
Executive priority
Low priority. Treat this as routine kernel hygiene rather than an incident-grade issue. Schedule it into the next normal Linux patch cycle, with no need for emergency change windows. Only escalate if the organization operates ARM OMAP-based embedded fleets where uptime and memory pressure matter.
Technical view
In arch/arm/mach-omap2/omap4-common.c, omap4_sram_init() calls of_find_compatible_node() but never invokes of_node_put() on the returned node, leaving its refcount incremented. This is a reference-count leak triggered during early platform setup on OMAP2+ boards. Stable kernels 6.1.16, 6.2.3, and 6.3 received the fix; older 3.18+ trees are listed as affected. No CVSS, CWE, or KEV signal is attached.
Likely exposure
Limited to Linux systems built with ARM OMAP2+/OMAP4 platform support, primarily older or embedded TI SoC devices. General-purpose servers, x86/x64 workloads, cloud instances, and most enterprise endpoints are not exposed. No remote or unauthenticated attack surface is described in the source bundle.
Exploitation context
No active exploitation is reported and the CVE is not in CISA KEV. The flaw is a refcount leak during platform init, not a memory-safety or privilege-escalation primitive, and the sources do not describe any attacker-controlled trigger. Practical impact is bounded to slow kernel resource accounting drift on affected ARM boards.
Researcher notes
Classic missing of_node_put() pattern after of_find_compatible_node(); functionally a refcount leak with no described path to memory corruption, info disclosure, or privilege escalation. No CVSS, CWE, KEV, or exploit telemetry in the bundle. Three stable git.kernel.org commits are referenced; map them to your downstream tree to confirm backport coverage. Confidence is bounded by the absence of severity scoring in upstream metadata.
Mitigation direction
- Inventory Linux hosts using ARM OMAP2+/OMAP4 board support to scope exposure.
- Upgrade affected kernels to 6.1.16, 6.2.3, 6.3, or later stable releases that include the fix.
- For long-term-support trees, pull the cited stable backport commits via your distribution's kernel package.
- Track vendor (distribution or device OEM) advisories for embedded products that may ship custom kernels.
Validation and detection
- Confirm running kernel version and whether ARM OMAP2+ support is compiled in (CONFIG_ARCH_OMAP2PLUS).
- Compare the deployed kernel against the fixed versions listed in the CVE record (6.1.16, 6.2.3, 6.3+).
- Inspect arch/arm/mach-omap2/omap4-common.c for the of_node_put() call after of_find_compatible_node().
- Review distribution changelogs for the cited stable commits to verify the patch was applied.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50539 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.