CVE-2022-50120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50120 is a reference count (refcount) leak vulnerability in the Linux kernel's remoteproc subsystem, specifically within the imx_rproc_addr_init function of the i.MX remote processor driver. The flaw arises because of_parse_phandle() returns a node pointer with an incremented reference count, but two code paths in imx_rproc_addr_init fail to call of_node_put() to release the reference when it is no longer needed. Affected kernel versions include 4.14–5.15.60, 5.16–5.18.17, and 5.19–5.19.1. The CVE was published on June 18, 2025, with patches available in the Linux kernel stable repositories. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper resource management (CWE-401: Missing Release of Memory after Effective Lifetime) in the imx_rproc_addr_init function within drivers/remoteproc/imx_rproc.c. When of_parse_phandle() is called to obtain a device tree node pointer, it increments the node's reference count; however, two error or early-exit paths in the function omit the corresponding of_node_put() call, causing the reference count to never reach zero and the associated memory to never be freed. This is a local, low-complexity issue requiring low privileges and no user interaction to trigger. No public proof-of-concept exploit code has been identified (Feedly, Kernel Patch 1).

Successful exploitation of this vulnerability by a local, low-privileged user could cause resource exhaustion in the kernel's device tree node reference tracking, leading to a denial of service condition. The availability impact is rated High, as repeated triggering could destabilize the system or render it unresponsive. There is no confidentiality or integrity impact associated with this vulnerability (Feedly).

There is no known public proof-of-concept exploit for CVE-2022-50120, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Update the Linux kernel to a patched stable version: 5.15.61 or later (for the 5.15.x branch), 5.18.18 or later (for the 5.18.x branch), or 5.19.2 or later (for the 5.19.x branch). Patches have been committed to the Linux kernel stable repositories and can be applied directly. As a secondary measure, restrict local user access to systems using i.MX-based remote processor hardware to reduce exposure. Monitoring for unusual kernel memory or resource consumption patterns may help detect anomalous behavior (Feedly, Kernel Patch 1, Kernel Patch 2).