CVE-2022-50724: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50724 is a resource leak vulnerability in the Linux kernel's regulator core subsystem, specifically within the regulator_register() function. The flaw causes memory and device node reference count leaks when error paths are taken during regulator registration, leading to of_node_get()/of_node_put() imbalances. It was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. The CVSS category is estimated as Medium, with an EPSS score of 0.000240 (Feedly, CVE.org).

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the regulator_register() function within the Linux kernel's drivers/regulator/core.c. When fault conditions occur during regulator registration — such as during device_add() or subsequent initialization steps — allocated memory objects (e.g., device_private structures, regulator name strings) and device tree node references are not properly released. This was discovered through fault injection testing, which revealed unbalanced of_node_get()/of_node_put() calls and unreferenced kernel objects persisting in memory. The fix involves ensuring all error paths in regulator_register() correctly release acquired resources (Feedly, CVE.org).

The primary impact is a kernel memory leak and device tree node reference count imbalance, which can degrade system stability over time, particularly on systems that frequently load and unload regulator drivers (e.g., embedded systems using device tree overlays). Repeated triggering of the vulnerable code path could exhaust kernel memory resources, potentially leading to denial of service. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (Feedly).

The fix has been applied to multiple Linux kernel stable branches via upstream commits (e.g., 6a03c31d, 90b713aa, 35593d60, ba62319a, c4c64d8a). Users should update to a patched kernel version that includes the fix for regulator_register() resource cleanup. SUSE has issued advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) addressing this CVE in their kernel packages (Linux Security SUSE, Feedly). No configuration-based workaround is available; patching is the recommended remediation.