CVE-2022-50111: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50111 is a reference count leak vulnerability in the Linux kernel's ASoC (Audio System on Chip) mt6359 driver. The flaw exists in the mt6359_parse_dt() and mt6359_accdet_parse_dt() functions, which fail to call of_node_put() on device tree node references obtained via of_get_child_by_name(), causing a reference count leak. Affected kernel versions include 5.10.x before 5.15.61, 5.16.x before 5.18.18, and 5.19.x before 5.19.2. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource management (CWE-401 / reference count mismanagement) in the Linux kernel's MediaTek mt6359 PMIC audio codec driver. When of_get_child_by_name() is called to retrieve a child device tree node, it increments the node's reference count; the driver fails to call the corresponding of_node_put() to decrement it after use, resulting in a persistent reference count leak. This is a local vulnerability requiring low privileges to trigger, with no user interaction needed. Patches addressing the issue are available via four kernel.org stable commits (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation of this vulnerability can lead to resource exhaustion and memory leaks within the Linux kernel, potentially causing system instability or denial-of-service conditions, particularly on long-running systems. There is no confidentiality or integrity impact; the primary risk is high availability impact due to gradual memory resource depletion. Systems using MediaTek mt6359-based audio hardware (commonly found in embedded and mobile platforms) are most at risk (Feedly).

There is no known public proof-of-concept exploit for CVE-2022-50111, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term (Feedly).

Update the Linux kernel to a patched version: 5.15.61 or later (for the 5.10–5.15 branch), 5.18.18 or later (for the 5.16–5.18 branch), or 5.19.2 or later (for the 5.19 branch). Patches are available via the following kernel.org stable commits: 1e7fe69, 3d69d86, a8d5df6, and ffaef89. As a short-term measure, minimize local user access to systems running affected kernel versions, and apply vendor-specific kernel security updates as they become available (Feedly).