CVE-2022-50887

What it actually does

Unbalanced of_node_get()/of_node_put() in regulator_dev_lookup() after of_parse_phandle() leaves device-tree node refcount incremented, causing a memory leak of OF nodes.

Why it matters to the business

Long-running Linux systems using device-tree regulators may experience gradual memory exhaustion; low urgency given zero KEV status and stable low EPSS.

How an attack unfolds

No known exploitation; the issue is a passive reference-count leak triggered during normal regulator device lookup rather than an attacker-controlled code path.

How to fix it

Update to a kernel containing commit 0e88505ac0a6ae97746bcdbd4b042ee9f20455ae or, for Bitnami vault, upgrade to 1.20.3; rebuild and reboot affected kernels.

How to confirm the fix worked

Verify the OF error message no longer appears on overlay load and confirm the fixed commit is present in /proc/version or kernel source.

How to detect it

Search kernel logs for the exact OF memory-leak warning string emitted when an overlay regulator node is attached.

• OF: ERROR: memory leak, expected refcount 1 instead of 2
• of_node_get()/of_node_put() unbalanced - destroy cset entry

What your security team should do

• Apply the referenced kernel commit or Bitnami 1.20.3 update on all device-tree-based systems
• Monitor dmesg for the OF refcount leak message
• Re-test regulator initialization after patching