CVE-2022-50777: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50777 is a reference count (refcount) leak vulnerability in the Linux kernel's net/phy/xgmiitorgmii.c driver, specifically in the xgmiitorgmii_probe function. The flaw arises because of_phy_find_device() returns a device node with its reference count incremented, but the code fails to call put_device() to release it when the reference is no longer needed. The vulnerability affects multiple stable Linux kernel branches starting from the introduction of the affected code (commit ab4e6ee578e8), with fixes backported to versions 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.19, 6.1.5, and 6.2. It was formally published on December 24, 2025, and carries an estimated CVSS severity of Medium (Feedly, EUVD).

The root cause is a missing put_device() call in the xgmiitorgmii_probe function of the Linux kernel's XGMII-to-RGMII PHY driver (CWE-401: Missing Release of Memory after Effective Lifetime). When of_phy_find_device() is called, it increments the reference count of the returned device node; if the probe function exits without calling put_device(), the reference count is never decremented, resulting in a kernel memory leak. This is a local, kernel-space issue triggered during device probing — typically at boot or when the relevant network PHY hardware is initialized. Patches addressing this issue are available across multiple stable kernel trees (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which can gradually degrade system stability and availability over time as unreleased device references accumulate. In practice, exploitation requires the affected XGMII-to-RGMII PHY hardware to be present and the driver to be loaded, limiting the affected population to systems with this specific network hardware. There is no known path to privilege escalation, remote code execution, or data exfiltration from this vulnerability; the confidentiality and integrity impacts are negligible (Feedly).

The fix is to apply the upstream kernel patches that add the missing put_device() call in xgmiitorgmii_probe. Patched versions are available for the following stable kernel releases: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.19, 6.1.5, and 6.2. Users should update to a patched kernel version; SUSE has also issued advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) for affected distributions (Feedly, Linux Security SUSE). No configuration-based workaround is available; unloading or blacklisting the xgmiitorgmii kernel module on systems that do not require it can reduce exposure.