LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50820: perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()

In the Linux kernel, the following vulnerability has been resolved: perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() dmc620_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path. Similar to the handling of arm_ccn_init() in commit 26242b330093 ("bus: arm-ccn: Prevent hotplug callback leak")

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50820 is a Linux kernel issue in the ARM DMC-620 performance-monitoring driver. If driver registration fails during initialization, a CPU hotplug callback may be left registered. The public record does not provide CVSS, confirmed impact, or exploitation evidence, so business urgency depends on whether your systems use this ARM-specific kernel driver.

Executive priority

Treat as a targeted kernel hygiene issue, not an emergency based on current public evidence. Prioritize validation for ARM infrastructure, embedded platforms, and appliances. Escalate if your vendor marks it high severity or confirms exploitable impact in your environment.

Technical view

The bug is in dmc620_pmu_init() in perf/arm_dmc620. The fix removes a cpuhp_setup_state_multi() callback using cpuhp_remove_multi_state() on the platform_driver_register() failure path. It is similar to a prior ARM CCN callback-leak fix. Public metadata is incomplete and version ranges appear ambiguous in the supplied record.

Likely exposure

Likely limited to Linux systems running kernels with the ARM DMC-620 PMU driver present and relevant hardware/platform support. General x86 Linux fleets are unlikely to be affected, based on the ARM-specific driver named in the record. Confirm against your kernel configuration and vendor kernel advisories.

Exploitation context

The source bundle does not identify active exploitation, a public exploit, attack prerequisites, or a CVSS score. CISA KEV status is false in the provided data. The described issue appears tied to an initialization failure path and leaked CPU hotplug callback, but the security impact is not fully explained publicly.

Researcher notes

The public CVE text only describes a missing cleanup path after platform_driver_register() failure. No CWE, CVSS, proof of exploitability, or concrete consequence is provided. Version metadata in the supplied bundle is not sufficiently clear to make precise affected/fixed determinations without vendor or upstream commit review.

Mitigation direction

  • Check Linux distribution or appliance vendor advisories for CVE-2022-50820 applicability.
  • Update affected kernels to vendor-provided fixed builds when available.
  • For custom kernels, review the referenced stable commits for backport status.
  • Prioritize ARM platforms using DMC-620 PMU support over unrelated Linux systems.

Validation and detection

  • Inventory ARM Linux systems and kernel versions.
  • Check whether the arm_dmc620 PMU driver is built or loaded.
  • Compare vendor kernel changelogs against the referenced upstream stable commits.
  • Document systems where DMC-620 hardware or driver support is absent.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50820 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux53c218da220c3619b5befec4674ffa35d590092a, 53c218da220c3619b5befec4674ffa35d590092a, 53c218da220c3619b5befec4674ffa35d590092a, 53c218da220c3619b5befec4674ffa35d590092aunaffected
LinuxLinux5.11, 0, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.