CVE-2022-50887 regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
A refcount imbalance in the Linux kernel regulator core can cause memory leaks, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50887?
CVE-2022-50887 is a memory corruption vulnerability in Linux, published on 30 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
I got the the following report:
OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@62/regulators/exten
In of_get_regulator(), the node is returned from of_parse_phandle() with refcount incremented, after using it, of_node_put() need be called.
Which versions are affected by CVE-2022-50887?
How do I fix CVE-2022-50887?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50887 being exploited?
There is no known exploitation of CVE-2022-50887 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50887, GHSA-jpr9-mqf4-fm6w, UBUNTU-CVE-2022-50887.