CVE-2022-50038: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50038 is a reference count (refcount) leak vulnerability in the Linux kernel's drm/meson DRM display driver, specifically within the meson_vpu_has_available_connectors() function. The flaw was published on June 18, 2025, and affects Linux kernel versions from 4.10 through 5.19.3 across multiple stable branches, as well as 6.0-rc1. Fixed versions include 4.14.291, 4.19.256, 5.4.211, 5.10.138, 5.15.63, and 5.19.4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper reference counting (CWE-401 — Missing Release of Memory after Effective Lifetime) in the meson_vpu_has_available_connectors() function of the drm/meson driver. Two distinct bugs exist: (1) when breaking out of the for_each_endpoint_of_node() loop early, of_node_put() is not called for the endpoint node ep, leaking its reference; and (2) the device tree node reference returned by of_graph_get_remote_port() is never released via of_node_put() after use. Exploitation requires local, low-privilege access (no user interaction needed), and the attack vector is local, making it a low-complexity but limited-scope issue (Feedly, git.kernel.org).

Successful exploitation can lead to resource exhaustion, system instability, or kernel crashes due to accumulated reference count leaks in device tree node management. The primary impact is availability — there is no confidentiality or integrity impact. Affected systems running the drm/meson driver (typically Amlogic SoC-based devices such as certain ARM single-board computers and embedded systems) may experience denial of service conditions over time (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported.

Apply the upstream Linux kernel patches available for each affected stable branch: upgrade to 4.14.291, 4.19.256, 5.4.211, 5.10.138, 5.15.63, 5.19.4, or later. SUSE has released kernel security updates (e.g., SUSE-2025-02264-1, SUSE-2025-02308-1, SUSE-2025-02537-1) addressing this CVE (Linux Security SUSE Advisory). As a workaround where patching is not immediately possible, restrict local user access to trusted accounts and monitor for unusual system instability or memory pressure on affected Amlogic-based systems (Feedly).