CVE-2022-50703: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50703 is a refcount leak vulnerability in the Linux kernel's Qualcomm SMSM (Shared Memory State Machine) driver, specifically within the qcom_smsm_probe() function in soc/qcom/smsm.c. Two device-tree node reference counting bugs allow reference counts to leak when iterating over child nodes: one via for_each_child_of_node() and another via for_each_available_child_of_node(). The vulnerability was published on December 24, 2025, and affects Linux kernel versions from the introduction of the SMSM driver (around v4.5) through multiple stable branches. No CVSS score has been assigned by NVD at this time, and the record is not scheduled for NVD enrichment prioritization (Feedly, NVD).

The root cause is improper reference count management (CWE-401 / resource leak) in the qcom_smsm_probe() function of the Linux kernel's Qualcomm SMSM driver. In the first bug, local_node escapes the for_each_child_of_node() loop via a break statement without a corresponding of_node_put() call in the error path or after the node is no longer needed. In the second bug, node escapes for_each_available_child_of_node() via a goto statement, and the goto target does not call of_node_put() to release the reference. Both issues result in device-tree node reference counts never being decremented, causing a kernel memory resource leak (Feedly, NVD).

The primary impact of this vulnerability is a kernel memory resource leak, as device-tree node objects are never freed due to the unreleased reference counts. This can lead to gradual memory exhaustion on affected systems running Qualcomm SMSM-based hardware (e.g., Qualcomm SoC platforms), potentially degrading system stability or availability over time. There is no known direct path to privilege escalation, code execution, or data exfiltration from this vulnerability; the impact is limited to availability through resource exhaustion (Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (Feedly). The fixes add the missing of_node_put() calls in the appropriate error paths and goto targets within qcom_smsm_probe(). Users running affected kernel versions on Qualcomm SoC-based hardware should update to a patched kernel version. SUSE Linux has also issued advisories addressing this CVE as part of broader kernel security updates (Linux Security SUSE).

The vulnerability received routine coverage as part of SUSE Linux kernel security advisories and was included in a CISA vulnerability summary for the week of December 22, 2025. No notable independent researcher commentary or significant community discussion has been identified beyond standard patch tracking and scanner detection by Nessus (plugin 279972) and Qualys (detection 760731) (Feedly, Tenable).