CVE-2022-50777 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
of_phy_find_device() return device node with refcount incremented. Call put_device() to relese it when not needed anymore.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability identified as CVE-2022-50777 represents a memory management issue within the Linux kernel's phy subsystem, specifically affecting the xgmiitorgmii driver component. This flaw manifests as a reference count leak that occurs during the probe phase of device initialization, creating a potential memory exhaustion scenario that could impact system stability and resource availability. The issue resides in the network physical layer (PHY) handling mechanisms where device node references are improperly managed, leading to resource accumulation over time.
The technical root cause stems from improper handling of device node references returned by the of_phy_find_device() function which increments the reference count of the device node upon return. When the xgmiitorgmii_probe function processes this returned device node, it fails to call put_device() to decrement the reference count when the device node is no longer needed, resulting in a persistent reference that prevents the underlying device structure from being properly freed. This reference count leak directly violates proper resource management principles and creates a memory consumption pattern that grows with each device probe operation.
The operational impact of this vulnerability extends beyond simple memory consumption, potentially leading to system instability, performance degradation, and in severe cases, denial of service conditions. When multiple network interfaces or PHY devices are probed repeatedly, the cumulative effect of these reference leaks can exhaust available memory resources, particularly in embedded systems or environments with limited memory constraints. The vulnerability affects systems utilizing the xgmiitorgmii driver for managing gigabit ethernet interfaces, making it relevant to networking equipment, servers, and embedded devices that require proper PHY device management.
Security implications arise from the potential for resource exhaustion attacks that could be exploited by malicious actors to cause system instability or denial of service conditions. The vulnerability aligns with CWE-404, which addresses improper resource management, and demonstrates characteristics consistent with ATT&CK technique T1499.001 for resource exhaustion. Mitigation strategies should focus on implementing proper reference counting practices, ensuring that every call to of_phy_find_device() is matched with an appropriate put_device() call, and conducting thorough code reviews of similar driver components to identify and prevent analogous issues. System administrators should prioritize kernel updates to address this vulnerability and implement monitoring for memory consumption patterns that could indicate resource leak occurrences. The fix requires careful attention to device node reference management throughout the driver lifecycle, ensuring that all acquired references are properly released to maintain system stability and prevent potential exploitation scenarios.