CVE-2022-50825: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50825 is a memory leak vulnerability in the Linux kernel's USB Type-C WUSB3801 driver, specifically in the wusb3801_probe() function. The flaw causes an fwnode reference count leak when wusb3801_hw_init() fails during device probing, as fwnode_handle_put() is not called on the error path. It was published on December 30, 2025, and affects Linux kernel versions starting from the introduction of the wusb3801 driver (around 5.18) up to the patched releases 6.0.16, 6.1.2, and 6.2. The CVSS base score is 0.0 as assessed by ENISA, reflecting its low exploitability and limited security impact (Feedly).

The root cause is an improper reference count management (CWE-911: Improper Update of Reference Count) in the wusb3801_probe() function of the Linux kernel's drivers/usb/typec/wusb3801.c. When wusb3801_hw_init() returns an error, the code path exits without calling fwnode_handle_put() to decrement the firmware node reference count, resulting in an unbalanced of_node_get()/of_node_put() pair. This was identified during fault injection testing, which triggered the kernel's OF (Open Firmware) subsystem to report: OF: ERROR: memory leak, expected refcount 1 instead of 4. The fix adds the missing fwnode_handle_put() call on the failure path (Feedly).

The primary impact of this vulnerability is a kernel memory leak in systems using the WUSB3801 USB Type-C controller. The leaked firmware node reference prevents proper cleanup of device tree overlay nodes, which can lead to resource exhaustion over time if the probe failure condition is repeatedly triggered (e.g., via repeated device attachment/detachment cycles). There is no known path to privilege escalation, code execution, or data exfiltration; the impact is limited to availability degradation on affected embedded or mobile systems using this specific hardware (Feedly).

The Linux kernel stable tree has released patches addressing this vulnerability in versions 6.0.16, 6.1.2, and 6.2. The fix adds a call to fwnode_handle_put() on the error path in wusb3801_probe() when wusb3801_hw_init() fails. Users running affected kernel versions on systems with WUSB3801 USB Type-C hardware should update to a patched kernel release. The relevant upstream commits are available at the kernel stable repository (Feedly).