CVE-2022-50121 in Linux
Summary
by MITRE • 06/18/2025
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init
Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node. When breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node. Add missing of_node_put() to avoid refcount leak.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/01/2025
The vulnerability CVE-2022-50121 represents a reference count leak in the Linux kernel's remote processor subsystem, specifically within the k3-r5 cluster initialization function. This issue affects the remoteproc framework which is responsible for managing remote processors in embedded systems, particularly those utilizing Texas Instruments' K3 SoC architectures. The flaw exists in the k3_r5_cluster_of_init function where the kernel fails to properly manage device tree node references during iterative processing.
The technical root cause stems from improper handling of device tree node reference counting within the for_each_available_child_of_node() macro implementation. This macro automatically decrements the reference count of previously processed nodes during each iteration, but when the loop terminates early through a break statement, the current node reference remains unreleased. The missing of_node_put() call prevents proper cleanup of the device tree node reference, leading to a memory leak that accumulates over time. This pattern violates fundamental resource management principles and represents a classic case of reference counting error that can be classified under CWE-404 as improper resource release or unbounded resource consumption.
The operational impact of this vulnerability manifests as gradual memory consumption degradation within kernel space, potentially leading to system instability or resource exhaustion in long-running embedded systems. The k3-r5 remote processor implementation is commonly used in industrial automation, telecommunications equipment, and automotive applications where reliable memory management is critical. Attackers could potentially exploit this leak to cause denial of service conditions, particularly in environments where the system operates continuously for extended periods without rebooting. The vulnerability affects systems utilizing the TI K3 SoC family and any kernel versions incorporating the problematic remoteproc driver code, making it relevant to a broad range of embedded Linux deployments.
Mitigation strategies should focus on applying the upstream kernel patch that introduces the missing of_node_put() call in the k3_r5_cluster_of_init function. System administrators should prioritize updating kernel versions to those containing the fix, particularly in production environments where memory stability is paramount. Additionally, monitoring for memory consumption patterns in systems utilizing k3-r5 remote processor functionality can help detect potential exploitation attempts. The fix aligns with ATT&CK technique T1499.001 for resource exhaustion attacks, where improper resource management can be leveraged to degrade system performance. Organizations should also implement regular kernel patching policies and consider using kernel hardening techniques such as stack canaries and memory protection mechanisms to reduce the attack surface. This vulnerability demonstrates the critical importance of proper reference counting in kernel space operations and serves as a reminder of the potential for seemingly minor code defects to cause significant operational impacts in embedded systems.