LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50734: nvmem: core: Fix memleak in nvmem_register()

In the Linux kernel, the following vulnerability has been resolved: nvmem: core: Fix memleak in nvmem_register() dev_set_name will alloc memory for nvmem->dev.kobj.name in nvmem_register, when nvmem_validate_keepouts failed, nvmem's memory will be freed and return, but nobody will free memory for nvmem->dev.kobj.name, there will be memleak, so moving nvmem_validate_keepouts() after device_register() and let the device core deal with cleaning name in error cases.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50734 is a Linux kernel memory leak in the nvmem registration path. In a specific error case, allocated device-name memory was not freed. Public sources do not provide CVSS, confirmed exploitation, or business-impact details, so urgency should be driven by kernel exposure and normal patch cycles.

Executive priority

Treat as routine kernel hygiene unless your environment has high kernel-stability requirements or affected embedded/Linux devices. There is no sourced evidence of active exploitation, but memory leaks can affect reliability and should be remediated through normal maintenance windows.

Technical view

In nvmem_register(), dev_set_name allocates memory for nvmem->dev.kobj.name. If nvmem_validate_keepouts() failed, nvmem memory was freed without freeing that name allocation. The kernel fix moves validation after device_register(), allowing device core cleanup on error paths.

Likely exposure

Potentially exposed systems are Linux kernels matching the affected version information in the CVE record, including listed 5.15, 5.15.75, 5.19.17, 6.0.3, and 6.1 entries. Distribution backports may change practical exposure, so verify against vendor kernel advisories.

Exploitation context

No CISA KEV entry or cited source indicates active exploitation. The public description shows a memory leak on a kernel error path, not a disclosed privilege-escalation or remote-code-execution path. Triggerability and real-world impact are not established in the provided sources.

Researcher notes

Evidence is limited to the CVE record and kernel stable commits. No CVSS, CWE, exploit status, or distro-specific affected package list is provided. Review the referenced commits for exact backport context before declaring specific downstream kernels vulnerable or fixed.

Mitigation direction

  • Check Linux distribution advisories for CVE-2022-50734 applicability.
  • Update to a vendor kernel containing the referenced stable fixes.
  • Prioritize systems using kernels in the affected ranges.
  • If unsupported, plan kernel upgrade or vendor-supported replacement.

Validation and detection

  • Inventory running kernel versions across Linux assets.
  • Map distro kernels to upstream stable fixes or vendor advisories.
  • Confirm whether the nvmem subsystem is present and relevant.
  • Track remediation through package, image, or firmware baselines.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50734 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxde0534df93474f268486c486ea7e01b44a478026, de0534df93474f268486c486ea7e01b44a478026, de0534df93474f268486c486ea7e01b44a478026, de0534df93474f268486c486ea7e01b44a478026, c1d44b93ca9f3ebc26b0de0a7f4b7156702762b6, 63c2b13ba0428b8f477e4adb1d40a50eb4493c09unaffected
LinuxLinux5.15, 0, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.