CVE-2022-50152: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50152 is a reference count leak vulnerability in the Linux kernel's USB OHCI (Open Host Controller Interface) driver for NXP platforms, specifically in the ohci_hcd_nxp_probe function. The flaw arises because of_parse_phandle() returns a node pointer with an incremented reference count, but the code fails to call of_node_put() to release it when no longer needed. Affected Linux kernel versions span from 3.5 up to (but not including) fixed releases: 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2. The CVE was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Linux Kernel Patches).

The root cause is an improper resource management issue (CWE-401: Missing Release of Memory after Effective Lifetime) in the ohci_hcd_nxp_probe function of the Linux kernel's usb/host/ohci-nxp.c driver. When of_parse_phandle() is called to retrieve a device tree node, it increments the node's reference count; without a corresponding of_node_put() call on all exit paths, the reference count is never decremented, causing a slow resource leak. Exploitation requires local access with low privileges (e.g., triggering USB device probe events), and the attack vector is local with no user interaction required (Feedly). Patches adding the missing of_node_put() call have been applied across multiple stable kernel branches (Linux Kernel Patches).

The primary impact is a gradual resource exhaustion of kernel memory reference counts, which over time can degrade system stability and performance, particularly on NXP-based embedded systems with frequent USB device interactions. There is no direct confidentiality or integrity impact; the vulnerability is limited to availability, as prolonged operation without patching may lead to reduced system reliability. The scope is confined to the local system and does not enable lateral movement or data exfiltration (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-50152. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

The recommended remediation is to update the Linux kernel to a patched version: 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, or 5.19.2 (or later). For systems that cannot be immediately patched, administrators should monitor system resource usage for signs of memory pressure and limit local user access to reduce exposure. Implementing a regular kernel update cadence as part of standard security maintenance is advised (Feedly, Linux Kernel Patches). SUSE has also issued a security advisory (SUSE-2025-02308-1) addressing this and related kernel issues (SUSE Advisory).

SUSE issued a security advisory (SUSE-2025-02308-1) covering this vulnerability among multiple Linux kernel issues, rated as Important (SUSE Advisory). Tenable has flagged the CVE in multiple plugin pipeline issues, indicating scanner coverage for detection (Tenable). No notable independent researcher commentary or significant social media discussion has been observed for this low-severity kernel maintenance fix.