CVE-2022-50017 mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
A missing reference count decrement in the Linux kernel's Cavium Octeon USB driver can lead to a resource leak and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50017?
CVE-2022-50017 is a medium-severity vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
We should call of_node_put() for the reference 'uctl_node' returned by of_get_parent() which will increase the refcount. Otherwise, there will be a refcount leak bug.
Which versions are affected by CVE-2022-50017?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50017?
Apply the vendor's patch.
Is CVE-2022-50017 being exploited?
There is no known exploitation of CVE-2022-50017 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50017, GHSA-4x6m-cqxf-jch7, UBUNTU-CVE-2022-50017.