{
  "cveId": "CVE-2022-50457",
  "url": "https://patchblox.com/security/cve/CVE-2022-50457",
  "summary": "CVE-2022-50457 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50457, released October 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  mtd: core: Fix refcount error in del_mtd_device(...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  mtd: core: Fix refcount error in del_mtd_device()  del_mtd_device() will call of_node_put() to mtd_get_of_node(mtd), which is mtd-\u003Edev.of_node. However, memset(\u0026mtd-\u003Edev, 0) is called before of_node_put(). As the result, of_node_put() won\u0027t do anything in del_mtd_device(), and causes the refcount leak.  del_mtd_device()     memset(\u0026mtd-\u003Edev, 0, sizeof(mtd-\u003Edev) # clear mtd-\u003Edev     of_node_put()         mtd_get_of_node(mtd) # mtd-\u003Edev is cleared, can\u0027t locate of_node                              # of_node_put(NULL) won\u0027t do anything  Fix the error by caching the pointer of the device_node.  OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /spi/spi-sram@0 CPU: 3 PID: 275 Comm: python3 Tainted: G N 6.1.0-rc3\u002B #54     0d8a1edddf51f172ff5226989a7565c6313b08e2 Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace: \u003CTASK\u003E     dump_stack_lvl\u002B0x67/0x83     kobject_get\u002B0x155/0x160     of_node_get\u002B0x1f/0x30     of_fwnode_get\u002B0x43/0x70     fwnode_handle_get\u002B0x54/0x80     fwnode_get_nth_parent\u002B0xc9/0xe0     fwnode_full_name_string\u002B0x3f/0xa0     device_node_string\u002B0x30f/0x750     pointer\u002B0x598/0x7a0     vsnprintf\u002B0x62d/0x9b0     ...     cfs_overlay_release\u002B0x30/0x90     config_item_release\u002B0xbe/0x1a0     config_item_put\u002B0x5e/0x80     configfs_rmdir\u002B0x3bd/0x540     vfs_rmdir\u002B0x18c/0x320     do_rmdir\u002B0x198/0x330     __x64_sys_rmdir\u002B0x2c/0x40     do_syscall_64\u002B0x37/0x90     entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  [\u003Cmiquel.raynal@bootlin.com\u003E: Light reword of the commit log]",
  "published": "2025-10-01T12:15:38Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00159,
  "epssPercentile": 0.05086,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50457",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50457",
      "released": "2025-10-01T12:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50457",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50457",
      "released": "2025-10-01T12:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.4-1",
      "fix": "DEBIAN-CVE-2022-50457",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50457",
      "released": "2025-10-01T12:15:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}