CVE-2022-50823: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50823 is a reference count leak vulnerability in the Linux kernel's Tegra clock driver (clk: tegra), specifically in the tegra114_clock_init function. The issue arises because of_find_matching_node() returns a node pointer with an incremented reference count, but the code fails to call of_node_put() when the node is no longer needed, resulting in a refcount leak. It affects Linux kernel versions from commit 2cb5efefd6f7 up to the respective stable branch fixes, and was publicly disclosed on December 30, 2025. The EPSS score is approximately 0.033% (very low), and no CVSS score has been formally assigned (Feedly, ENISA EUVD).

The root cause is a missing of_node_put() call in tegra114_clock_init within the Linux kernel's drivers/clk/tegra/ subsystem, classified as CWE-401 (Missing Release of Memory after Effective Lifetime) or more precisely a reference count management error. The of_find_matching_node() API increments the reference count of the returned device tree node, and callers are responsible for decrementing it via of_node_put() when done; omitting this call causes the reference count to never reach zero, preventing proper cleanup. This is a local, kernel-internal issue triggered during system initialization on Tegra 114-based hardware. Fixes were backported across multiple stable kernel branches (Feedly, ENISA EUVD).

The primary impact is a kernel memory resource leak — specifically, a device tree node object whose reference count is never decremented, preventing its memory from being freed. This is an availability and resource management concern rather than a confidentiality or integrity issue; it does not directly enable code execution, privilege escalation, or data exfiltration. On long-running systems with Tegra 114 hardware, the leak could contribute to kernel memory exhaustion over time, though in practice the leak occurs once at boot during clock initialization (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched versions include: 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (mainline). Users running affected kernels on Tegra 114-based systems should upgrade to the respective patched stable release. SUSE has also issued kernel security updates addressing this CVE (Feedly, Linux Security SUSE).