Security readout for executives and security teams
Plain-English summary
CVE-2022-50713 is a Linux kernel memory leak in the Visconti clock driver. If a clock registration operation fails, allocated memory may not be released. The public record does not show remote exploitation, a CVSS score, or business-critical impact. Treat this as a targeted kernel maintenance issue unless your systems use this driver path.
Executive priority
Low priority for most enterprises. Address through normal kernel patch management, with higher attention for embedded Linux products or appliances using the Visconti driver. There is no provided evidence of exploitation or broad internet-facing risk.
Technical view
The flaw is in visconti_register_pll() in the Linux kernel clk/visconti code. Memory allocated for pll->rate_table with kmemdup() is not freed when clk_hw_register() fails. Stable kernel commits address the error path. The CVE record lists Linux kernel versions including 5.17, 6.0.16, 6.1.2, and 6.2 as affected.
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the Visconti clock driver code present and exercised. General servers, containers, and cloud workloads are unlikely to be exposed unless they run a kernel build including this hardware-specific driver.
Exploitation context
No cited source reports active exploitation, and the CVE is not listed as KEV in the provided data. The issue is a memory leak on a failure path, not a documented privilege escalation or remote code execution vulnerability.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit report, or detailed affected configuration matrix is provided. Avoid broad conclusions beyond the documented memory leak and listed kernel versions or commits.
Mitigation direction
- Check Linux distribution or device vendor advisories for kernels containing the stable fixes.
- Prioritize affected embedded or hardware-specific Linux builds using the Visconti clock driver.
- Update to a vendor-supported kernel release that includes the referenced stable commits.
- If no vendor fix is available, track upstream stable backports for this driver.
Validation and detection
- Inventory Linux kernel versions on potentially affected systems.
- Confirm whether the kernel build includes the Visconti clock driver code.
- Check vendor changelogs for the referenced stable commit identifiers.
- Verify patched source frees pll->rate_table when clk_hw_register() fails.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50713 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.