CVE-2022-50887: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50887 is a memory leak vulnerability in the Linux kernel's regulator subsystem, specifically in the regulator_dev_lookup() function within drivers/regulator/core.c. The flaw results from an unbalanced of_node_get()/of_node_put() reference count when of_get_regulator() returns a device tree node obtained via of_parse_phandle() without subsequently calling of_node_put() to release it. The vulnerability affects Linux kernel versions from 3.3 up through multiple stable branches prior to their respective fixes. It was published on December 30, 2025, and carries an estimated CVSS severity of Medium (Feedly, CIRCL Vulnerability Lookup).

The root cause is a missing of_node_put() call in of_get_regulator() within the Linux kernel regulator core (CWE-401: Missing Release of Memory after Effective Lifetime). When of_parse_phandle() returns a device tree node, it increments the node's reference count; if the caller does not call of_node_put() after use, the reference count becomes unbalanced (observed as refcount 2 instead of expected 1). This manifests particularly when device tree overlays are applied and destroyed, as the overlay framework detects the leaked reference and reports: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@62/regulators/exten. The bug is triggered in kernel configurations that use device tree-based regulator lookup, typically on embedded or ARM-based platforms (Feedly, CIRCL Vulnerability Lookup).

The primary impact is a kernel memory leak in the device tree node reference counting subsystem, which can lead to resource exhaustion over time, particularly on systems that frequently load and unload device tree overlays. This could degrade system stability and availability, potentially causing kernel warnings or system instability on affected embedded Linux platforms. The vulnerability does not directly enable remote code execution or privilege escalation, and its confidentiality and integrity impact is considered low; the main concern is availability on long-running systems with dynamic overlay management (Feedly).

• Logs: Kernel log messages containing OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced associated with regulator device tree nodes (e.g., /i2c/pmic@XX/regulators/...).
• Logs: Repeated kernel warnings during device tree overlay attach/detach cycles referencing the regulator subsystem (drivers/regulator/core.c).
• System Behavior: Gradual increase in kernel memory usage on systems with frequent device tree overlay operations, potentially observable via /proc/meminfo or kernel memory debugging tools such as kmemleak.

The Linux kernel stable team has released fixes across multiple stable branches. Patched versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The fix adds the missing of_node_put() call after the device tree node is used in of_get_regulator(). Users should update to the patched kernel version corresponding to their stable branch. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, CIRCL Vulnerability Lookup).