CVE-2022-50713: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50713 is a memory leak vulnerability in the Linux kernel's clock driver for Visconti SoCs, specifically within the visconti_register_pll() function in clk/visconti. When clk_hw_register() fails, the memory allocated by kmemdup() for pll->rate_table is not freed, resulting in a kernel memory leak. The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from 5.17 (commit b4cbe606dc36) up to the patched releases. It carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.017% (Feedly, CIRCL).

The root cause is a missing memory deallocation on an error path in visconti_register_pll() (CWE-401: Missing Release of Memory after Effective Lifetime). When clk_hw_register() returns an error, the function exits without calling kfree() on pll->rate_table, which was previously allocated via kmemdup(). This is a local, kernel-space issue requiring the error path to be triggered during PLL clock registration, typically at boot time or during driver initialization on affected Visconti SoC hardware (Feedly, ENISA EUVD).

The primary impact is a kernel memory leak, which can gradually exhaust available kernel memory on systems using Visconti SoC hardware if the affected code path is repeatedly triggered. This affects availability by potentially degrading system stability over time, but does not directly expose sensitive data or allow unauthorized code execution. The scope is limited to systems running affected Linux kernel versions on Visconti SoC platforms (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50713. The vulnerability is hardware-specific (Visconti SoC) and is triggered on an error path during kernel clock driver initialization, making opportunistic exploitation highly unlikely. The EPSS score is approximately 0.017%, reflecting very low exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The fix has been backported to stable Linux kernel releases. Patched commits are available for the stable trees: 70af9bf13be1 (6.1.2 stable), f0f1982ddfb4 (6.0.16 stable), and b55226f8553d (6.2 stable) (Kernel Git, Kernel Git, Kernel Git). Users running Linux kernel 5.17 or later on Visconti SoC hardware should update to kernel versions 6.0.16, 6.1.2, or 6.2+. No configuration-based workaround is available; upgrading the kernel is the recommended remediation.