CVE-2022-50724 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: fix resource leak in regulator_register()
I got some resource leak reports while doing fault injection test:
OF: ERROR: memory leak, expected refcount 1 instead of 100, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@64/regulators/buck1
unreferenced object 0xffff88810deea000 (size 512): comm "490-i2c-rt5190a", pid 253, jiffies 4294859840 (age 5061.046s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff a0 1e 00 a1 ff ff ff ff ................ backtrace: [<00000000d78541e2>] kmalloc_trace+0x21/0x110
[<00000000b343d153>] device_private_init+0x32/0xd0
[<00000000be1f0c70>] device_add+0xb2d/0x1030
[<00000000e3e6344d>] regulator_register+0xaf2/0x12a0
[<00000000e2f5e754>] devm_regulator_register+0x57/0xb0
[<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator]
unreferenced object 0xffff88810b617b80 (size 32): comm "490-i2c-rt5190a", pid 253, jiffies 4294859904 (age 5060.983s) hex dump (first 32 bytes): 72 65 67 75 6c 61 74 6f 72 2e 32 38 36 38 2d 53 regulator.2868-S 55 50 50 4c 59 00 ff ff 29 00 00 00 2b 00 00 00 UPPLY...)...+... backtrace: [<000000009da9280d>] __kmalloc_node_track_caller+0x44/0x1b0
[<0000000025c6a4e5>] kstrdup+0x3a/0x70
[<00000000790efb69>] create_regulator+0xc0/0x4e0
[<0000000005ed203a>] regulator_resolve_supply+0x2d4/0x440
[<0000000045796214>] regulator_register+0x10b3/0x12a0
[<00000000e2f5e754>] devm_regulator_register+0x57/0xb0
[<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator]
After calling regulator_resolve_supply(), the 'rdev->supply' is set by set_supply(), after this set, in the error path, the resources need be released, so call regulator_put() to avoid the leaks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability CVE-2022-50724 represents a resource leak in the Linux kernel's regulator subsystem, specifically within the regulator_register() function. This issue manifests as memory allocation inconsistencies during device driver initialization processes, particularly when handling device tree overlays and regulator device registration. The problem occurs when the kernel performs fault injection testing and identifies that reference counts are not properly balanced, indicating that memory objects allocated during regulator registration are not being correctly freed. The affected code path involves the interaction between device tree node management and regulator device creation, where the regulator subsystem fails to properly clean up resources when error conditions occur during the registration process.
The technical flaw stems from improper resource management in the regulator core subsystem where the regulator_resolve_supply() function sets up supply relationships for regulators but does not properly handle cleanup in error scenarios. When regulator_resolve_supply() calls set_supply() to establish the rdev->supply relationship, subsequent error paths fail to invoke regulator_put() to release the allocated resources. This creates a memory leak condition where kernel memory allocated for regulator device structures and associated data remains unreleased, leading to progressive memory consumption over time. The vulnerability is particularly concerning in embedded systems and mobile devices where memory resources are constrained and such leaks can lead to system instability or resource exhaustion.
The operational impact of this vulnerability extends beyond simple memory leaks to potentially compromise system stability and performance in production environments. The memory leaks accumulate during normal operation, especially when device drivers repeatedly register and unregister regulators, leading to gradual memory pressure that can affect system responsiveness and overall device performance. The issue is particularly relevant in complex embedded systems where multiple regulator drivers may be loaded simultaneously, and fault injection testing reveals the underlying resource management flaws. The vulnerability affects the Linux kernel's device tree overlay functionality, specifically when dealing with regulator device nodes and their associated supply relationships, making it a critical concern for kernel maintainers and embedded system developers.
Mitigation strategies for CVE-2022-50724 involve implementing proper error path handling in the regulator subsystem to ensure that all allocated resources are properly released when errors occur during regulator registration. The fix requires modifying the regulator_register() function to call regulator_put() in error scenarios after regulator_resolve_supply() has been invoked, ensuring that supply references are properly cleaned up. This approach aligns with the principle of resource management described in CWE-404, which addresses improper resource release, and follows ATT&CK techniques related to privilege escalation through resource exhaustion. The fix should be applied to all kernel versions that include the vulnerable regulator core implementation, with particular attention to systems using device tree overlays and regulator drivers that interact with power management subsystems. Security teams should prioritize patching this vulnerability in production systems, especially those operating in resource-constrained environments where memory leaks can have cascading effects on system stability and performance.