CVE-2022-50109: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50109 is a reference count leak vulnerability in the Linux kernel's video framebuffer (fbdev) AMBA CLCD driver. The flaw exists in the clcdfb_of_init_display() function, which fails to call of_node_put() for references returned by of_graph_get_next_endpoint() and of_graph_get_remote_port_parent(), resulting in improper reference counting on device tree nodes. Affected kernel versions span from 3.17 through 5.19.1, with fixed versions available across multiple stable branches. The vulnerability was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource management (CWE-401 / missing release of memory after effective lifetime) in the clcdfb_of_init_display() function within the Linux kernel's drivers/video/fbdev/amba-clcd.c. When the function iterates over device tree graph endpoints using of_graph_get_next_endpoint() and retrieves remote port parents via of_graph_get_remote_port_parent(), it increments reference counts on the returned device_node objects but does not call of_node_put() to release them — neither on the success path nor on error/failure paths. This results in reference count leaks that accumulate over time, particularly on systems where the AMBA CLCD display initialization is invoked repeatedly or during error recovery (Feedly, Kernel Patch).

Exploitation of this vulnerability by a local, low-privileged user could lead to gradual memory resource exhaustion on systems using the AMBA CLCD framebuffer driver, potentially causing system instability or a partial denial of service. There is no impact on confidentiality or integrity; the availability impact is rated High due to the potential for unmanaged reference counts to cause memory leaks and resource consumption over time. The scope is limited to the local system and does not facilitate lateral movement or data exfiltration (Feedly).

There is no public proof-of-concept exploit available for CVE-2022-50109, and no evidence of in-the-wild exploitation has been observed. The vulnerability requires local access with low privileges to trigger. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. CVE-2022-50109 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches have been released for all affected Linux kernel stable branches. Administrators should update to the following minimum fixed versions based on their branch: 4.14.291 (for 3.17–4.14.x), 4.19.256 (for 4.15–4.19.x), 5.4.211 (for 4.20–5.4.x), 5.10.137 (for 5.5–5.10.x), 5.15.61 (for 5.11–5.15.x), 5.18.18 (for 5.16–5.18.x), or 5.19.2 (for 5.19.x). As a compensating control where patching is not immediately possible, restricting local user access to systems running the AMBA CLCD driver and monitoring for unusual memory consumption can reduce risk (Feedly, Kernel Patch). SUSE has also issued a security advisory addressing this vulnerability (SUSE Advisory).

SUSE issued a security advisory (SUSE-2025-02308-1) covering this and other Linux kernel vulnerabilities, rated as Important (SUSE Advisory). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.