CVE-2022-50872: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50872 is a memory leak vulnerability in the Linux kernel's ARM OMAP2+ platform code, specifically within the realtime_counter_init() function. The sys_clk resource allocated by clk_get() is not released upon function return, resulting in a kernel memory leak. The vulnerability was published on December 30, 2025, and affects Linux kernel versions starting from commit fa6d79d27614 across multiple stable branches. It carries an estimated CVSS severity of Medium and an EPSS score of 0.000240 (Feedly, ENISA EUVD).

The root cause is a missing resource release (CWE-401: Missing Release of Memory after Effective Lifetime) in the realtime_counter_init() function within arch/arm/mach-omap2/. When clk_get() allocates the sys_clk clock resource, the function fails to call clk_put() before returning, leaving the memory unreleased. This is a local kernel-level issue with no network attack vector; exploitation would require local access or triggering the affected initialization path. Fixes were backported across multiple stable kernel branches, with patch commits available in the stable kernel repository (Feedly).

The primary impact is a kernel memory leak on systems using ARM OMAP2+ SoCs (e.g., certain embedded and mobile platforms running Linux). Over time, repeated triggering of the affected initialization path could degrade system availability by exhausting kernel memory resources. There is no direct confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

Apply the relevant stable kernel patches that introduce the clk_put(sys_clk) fix in realtime_counter_init(). Fixed versions include Linux kernel 4.14.308, 4.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3, and 6.3. Users running affected ARM OMAP2+ systems should update to a patched kernel version as soon as possible. No configuration-based workaround is available for this memory leak (Feedly).