CVE-2022-50480: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50480 is a vulnerability discovered in the Linux kernel related to a refcount leak bug in the pl353smcprobe() function. The issue was disclosed on October 4, 2025, affecting the memory subsystem, specifically the pl353-smc component (NVD, RedHat).

The vulnerability stems from a reference counting issue in the foreachavailablechildofnode() function where a corresponding ofnodeput() call is required when the reference 'child' is no longer needed. The bug occurs in the fail path where '!match' means no break is needed. While the ofplatformdevicecreate() creates a new reference by 'child', it has already handled the reference counting. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (RedHat).

The vulnerability could lead to memory leaks in the Linux kernel's memory management system, potentially affecting system stability and resource management (NVD).

The issue has been resolved in the Linux kernel through a patch that properly handles the reference counting in the pl353smcprobe() function. Red Hat has confirmed that several of their products, including Red Hat Enterprise Linux versions 6 through 10, are not affected by this vulnerability (RedHat).