CVE-2022-50477: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50477 is a vulnerability discovered in the Linux kernel's RTC (Real Time Clock) subsystem, specifically in the devmrtcallocate_device() function. The vulnerability was disclosed on October 4, 2025, affecting the RTC class implementation (NVD).

The vulnerability stems from a potential memory leak in the devmrtcallocatedevice() function. The function allocates an rtcdevice first and then runs devsetname(). If devsetname() fails, the rtc_device will leak memory. The issue was identified through a backtrace showing an unreferenced object of size 2048 bytes (RedHat).

The vulnerability results in a memory leak condition in the Linux kernel. While the immediate impact is resource consumption through memory leaks, this could potentially lead to system resource exhaustion over time. The severity is considered low to medium, as indicated by Red Hat's assessment (RedHat).

The vulnerability has been fixed by moving the devmaddactionorreset() call in front of devsetname() to prevent the memory leak. This fix has been implemented in the Linux kernel codebase (NVD).