CVE-2022-50644: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50644 is a resource reference leak vulnerability in the Linux kernel's clk: ti: dra7-atl clock driver, specifically in the of_dra7_atl_clk_probe function. The flaw arises because pm_runtime_get_sync() increments the power management (PM) runtime usage counter, but certain error paths fail to call the corresponding pm_runtime_put_sync(), resulting in a reference leak. The vulnerability affects the Linux kernel from version 3.16 onward, with fixes backported to stable releases including 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. It was published on December 9, 2025, and carries an estimated CVSS severity of Medium (Feedly, CIRCL).

The root cause is a missing resource release (CWE-772: Missing Release of Resource after Effective Lifetime) in the of_dra7_atl_clk_probe function within the Texas Instruments DRA7 Audio Timing Logic (ATL) clock driver (drivers/clk/ti/dra7-atl.c). When pm_runtime_get_sync() is called to enable the device's power domain, it increments an internal reference counter; however, if a subsequent error condition is encountered during probe, the code returns without calling pm_runtime_put_sync() to decrement the counter. This leaves the PM runtime reference count permanently elevated, preventing the device from being properly power-managed or released. The fix adds the missing pm_runtime_put_sync() calls in the affected error paths (Feedly, CIRCL).

The primary impact of this vulnerability is a kernel-level resource leak affecting power management state for the DRA7 ATL clock device. The leaked PM runtime reference prevents the device from entering low-power states, potentially causing increased power consumption and preventing proper device teardown or re-initialization. This is a local, low-severity issue with no direct confidentiality or integrity impact; availability may be marginally affected on embedded or power-constrained systems (such as TI DRA7-based SoCs) where power management correctness is critical (Feedly).

CVE-2022-50644 has an EPSS score of approximately 0.033% (0.000330), indicating a very low probability of exploitation in the wild. There is no known public proof-of-concept exploit, no evidence of in-the-wild exploitation, no threat actor attribution, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is limited to systems using TI DRA7-based hardware with the affected ATL clock driver loaded (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Users should update to the following patched versions or later: 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, or 6.1. Downstream distributions such as SUSE have also issued kernel security updates incorporating this fix (e.g., SUSE advisories SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0350-1, SUSE-2026-0411-1). Systems not using TI DRA7-based SoCs are not affected by this driver and require no action (Feedly, Linux Security).