Security readout for executives and security teams
Plain-English summary
CVE-2022-50644 is a Linux kernel bug in a TI DRA7 clock driver. In some failure paths, the driver fails to release a runtime power-management reference. This can leak references and potentially cause stability or power-management issues on affected systems. Public sources do not provide CVSS, CWE, or confirmed real-world exploitation.
Executive priority
Treat this as a maintenance-priority kernel issue unless you operate TI DRA7-based Linux devices at scale. There is no cited evidence of active exploitation, but affected embedded systems should receive vendor kernel updates to reduce stability and lifecycle risk.
Technical view
The issue is in of_dra7_atl_clk_probe in the Linux kernel clk: ti: dra7-atl driver. pm_runtime_get_sync() increments a PM usage counter, but some error paths did not call pm_runtime_put_sync(), causing a reference leak. Stable kernel commits add the missing put operation.
Likely exposure
Exposure appears limited to Linux systems using the TI DRA7 ATL clock driver. This is most relevant to embedded or SoC-based Linux deployments with that driver and hardware path. Generic Linux servers are less likely to be exposed, but kernel configuration and device usage should be verified.
Exploitation context
No provided source reports active exploitation, and the CVE is not marked KEV. The public description indicates a resource/reference leak in kernel error handling, not a documented privilege-escalation or remote-code-execution path. Impact details are incomplete in the supplied sources.
Researcher notes
The CVE record lacks CVSS, CWE, and detailed impact analysis. The available evidence supports a PM runtime reference leak fixed by stable Linux commits. Further assessment should focus on reachable probe error paths, affected kernel branches, vendor backports, and whether deployed hardware actually exercises this driver.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fixes.
- Check Linux distribution or device-vendor advisories for backported patches.
- Prioritize systems using TI DRA7 ATL hardware or related kernel configuration.
- If no vendor fix is available, request guidance from the kernel or device vendor.
Validation and detection
- Inventory Linux kernel versions across affected embedded and device fleets.
- Confirm whether the TI DRA7 ATL clock driver is built or used.
- Compare kernel source or package changelogs against the referenced stable commits.
- Verify vendor kernel advisories for CVE-2022-50644 coverage.
- Track remediation status in normal kernel patch management records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50644 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/27abe45df1dc394c184688d816cbbf2f194d4c6aCVE reference
- https://git.kernel.org/stable/c/d84f77ef7d57658d7346f8c4797a570aa5e35fa6CVE reference
- https://git.kernel.org/stable/c/25fe7b0d596b343e7a5504ba11767115fff8494fCVE reference
- https://git.kernel.org/stable/c/fc39ebf85d0349366b807fe2be848041c8523f03CVE reference
- https://git.kernel.org/stable/c/6d01017247eee3fba399f601b0bcb38e4fb88a72CVE reference
- https://git.kernel.org/stable/c/3441076f83aace85f5d6ccd9ffb301ac6b874776CVE reference
- https://git.kernel.org/stable/c/a9f69663ad571cbd7814dde38e3fcb4876341ed6CVE reference
- https://git.kernel.org/stable/c/c01ae99a4e3a0cdf70f7cd758a60a2243eac562cCVE reference
- https://git.kernel.org/stable/c/9c59a01caba26ec06fefd6ca1f22d5fd1de57d63CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.