CVE-2022-50724 - Vulnerability Details

- regulator: core: fix resource leak in regulator_register()

Description

In the Linux kernel, the following vulnerability has been resolved:

regulator: core: fix resource leak in regulator_register()

I got some resource leak reports while doing fault injection test:

OF: ERROR: memory leak, expected refcount 1 instead of 100,
of_node_get()/of_node_put() unbalanced - destroy cset entry:
attach overlay node /i2c/pmic@64/regulators/buck1

unreferenced object 0xffff88810deea000 (size 512):
comm "490-i2c-rt5190a", pid 253, jiffies 4294859840 (age 5061.046s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff a0 1e 00 a1 ff ff ff ff ................
backtrace:
[<00000000d78541e2>] kmalloc_trace+0x21/0x110
[<00000000b343d153>] device_private_init+0x32/0xd0
[<00000000be1f0c70>] device_add+0xb2d/0x1030
[<00000000e3e6344d>] regulator_register+0xaf2/0x12a0
[<00000000e2f5e754>] devm_regulator_register+0x57/0xb0
[<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator]

unreferenced object 0xffff88810b617b80 (size 32):
comm "490-i2c-rt5190a", pid 253, jiffies 4294859904 (age 5060.983s)
hex dump (first 32 bytes):
72 65 67 75 6c 61 74 6f 72 2e 32 38 36 38 2d 53 regulator.2868-S
55 50 50 4c 59 00 ff ff 29 00 00 00 2b 00 00 00 UPPLY...)...+...
backtrace:
[<000000009da9280d>] __kmalloc_node_track_caller+0x44/0x1b0
[<0000000025c6a4e5>] kstrdup+0x3a/0x70
[<00000000790efb69>] create_regulator+0xc0/0x4e0
[<0000000005ed203a>] regulator_resolve_supply+0x2d4/0x440
[<0000000045796214>] regulator_register+0x10b3/0x12a0
[<00000000e2f5e754>] devm_regulator_register+0x57/0xb0
[<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator]

After calling regulator_resolve_supply(), the 'rdev->supply' is set
by set_supply(), after this set, in the error path, the resources
need be released, so call regulator_put() to avoid the leaks.

Published: 2025-12-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0120ec32a7774b5061ced1a9a7ff833edd8b4cb6`	affected	< 35593d60b1622834984c43add7646d4069671aa9
`aea6cb99703e17019e025aa71643b4d3e0a24413`	affected	< 6a03c31d08f95dca9633a552de167b9e625833a8
`aea6cb99703e17019e025aa71643b4d3e0a24413`	affected	< c4c64d8abd656b9807b63178750fa91454602b86
`aea6cb99703e17019e025aa71643b4d3e0a24413`	affected	< 90b713aadc1240bf2dd03d610d6c1d016a9123a2
`aea6cb99703e17019e025aa71643b4d3e0a24413`	affected	< f86b2f216636790d5922458578825e4628fb570f
`aea6cb99703e17019e025aa71643b4d3e0a24413`	affected	< ba62319a42c50e6254e98b3f316464fac8e77968
`1d58235c062309d51660fd04182d7a8ab6a48ad6`	affected	—
`167c3b1f9793a1fb23e75e693f078420850306d4`	affected	—
`3fc99e38fdbf6b693693f861aa55a50a74c2d202`	affected	—
`96c6b5d5775637b3095ef934f871044811fd4db7`	affected	—
`f58ce31b05b4ca0c200a5cbe4724efe279405095`	affected	—
`5.4.73`	affected	< 5.4.229
`4.9.241`	affected	< 4.10
`4.14.203`	affected	< 4.15
`4.19.153`	affected	< 4.20
`5.8.17`	affected	< 5.9
`5.9.2`	affected	< 5.10

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.4.229`	unaffected	≤ 5.4.*
`5.10.163`	unaffected	≤ 5.10.*
`5.15.86`	unaffected	≤ 5.15.*
`6.0.16`	unaffected	≤ 6.0.*
`6.1.2`	unaffected	≤ 6.1.*
`6.2`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/35593d60b1622834984c43add7646d4069671aa9
https://git.kernel.org/stable/c/6a03c31d08f95dca9633a552de167b9e625833a8
https://git.kernel.org/stable/c/90b713aadc1240bf2dd03d610d6c1d016a9123a2
https://git.kernel.org/stable/c/ba62319a42c50e6254e98b3f316464fac8e77968
https://git.kernel.org/stable/c/c4c64d8abd656b9807b63178750fa91454602b86
https://git.kernel.org/stable/c/f86b2f216636790d5922458578825e4628fb570f
https://lore.kernel.org/linux-cve-announce/2025122418-CVE-2022-50724-f625@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-50724
https://www.cve.org/CVERecord?id=CVE-2022-50724

History

Thu, 25 Dec 2025 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025122418-CVE-2022-50724-f625@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2022-50724 https://www.cve.org/CVERecord?id=CVE-2022-50724
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 24 Dec 2025 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix resource leak in regulator_register() I got some resource leak reports while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 100, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@64/regulators/buck1 unreferenced object 0xffff88810deea000 (size 512): comm "490-i2c-rt5190a", pid 253, jiffies 4294859840 (age 5061.046s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff a0 1e 00 a1 ff ff ff ff ................ backtrace: [<00000000d78541e2>] kmalloc_trace+0x21/0x110 [<00000000b343d153>] device_private_init+0x32/0xd0 [<00000000be1f0c70>] device_add+0xb2d/0x1030 [<00000000e3e6344d>] regulator_register+0xaf2/0x12a0 [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0 [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator] unreferenced object 0xffff88810b617b80 (size 32): comm "490-i2c-rt5190a", pid 253, jiffies 4294859904 (age 5060.983s) hex dump (first 32 bytes): 72 65 67 75 6c 61 74 6f 72 2e 32 38 36 38 2d 53 regulator.2868-S 55 50 50 4c 59 00 ff ff 29 00 00 00 2b 00 00 00 UPPLY...)...+... backtrace: [<000000009da9280d>] __kmalloc_node_track_caller+0x44/0x1b0 [<0000000025c6a4e5>] kstrdup+0x3a/0x70 [<00000000790efb69>] create_regulator+0xc0/0x4e0 [<0000000005ed203a>] regulator_resolve_supply+0x2d4/0x440 [<0000000045796214>] regulator_register+0x10b3/0x12a0 [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0 [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator] After calling regulator_resolve_supply(), the 'rdev->supply' is set by set_supply(), after this set, in the error path, the resources need be released, so call regulator_put() to avoid the leaks.
Title		regulator: core: fix resource leak in regulator_register()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/35593d60b1622834984c43add7646d4069671aa9 https://git.kernel.org/stable/c/6a03c31d08f95dca9633a552de167b9e625833a8 https://git.kernel.org/stable/c/90b713aadc1240bf2dd03d610d6c1d016a9123a2 https://git.kernel.org/stable/c/ba62319a42c50e6254e98b3f316464fac8e77968 https://git.kernel.org/stable/c/c4c64d8abd656b9807b63178750fa91454602b86 https://git.kernel.org/stable/c/f86b2f216636790d5922458578825e4628fb570f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-24T12:22:46.251Z

Updated: 2026-05-23T15:24:58.423Z

Reserved: 2025-12-24T12:20:40.330Z

Link: CVE-2022-50724

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2025-12-24T13:15:59.057

Modified: 2026-04-15T00:35:42.020

Link: CVE-2022-50724

Redhat

Severity : Low

Publid Date: 2025-12-24T00:00:00Z

Links: CVE-2022-50724 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object