What’s Vulnerable › Vulnerabilities

CVE-2022-50160: mtd: maps: Fix refcount leak in ap_flash_init

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: Fix refcount leak in ap_flash_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.

Affected products

• Linux kernel: from 4.7 before 4.14.291; from 4.15 before 4.19.256; from 4.20 before 5.4.211; from 5.5 before 5.10.137; from 5.11 before 5.15.61; from 5.16 before 5.18.18 — fixed in 4.14.291, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2

How to fix

Upgrade to a fixed version: Linux kernel 4.14.291, 4.19.256, 5.10.137, 5.15.61. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/77087a04c8fd554134bddcb8a9ff87b21f357926
• https://git.kernel.org/stable/c/80b1465b2ae81ebb59bbe62bcb7a7f7d4e9ece6f
• https://git.kernel.org/stable/c/941ef6997f9db704fe4fd62fc01e420fdd5048b2
• https://git.kernel.org/stable/c/995fb2874bb5696357846a91e59181c600e6aac8
• https://git.kernel.org/stable/c/a74322d4b897ddc268b340c4a397f6066c2f945d
• https://git.kernel.org/stable/c/babd7b0124650ab71a6487e38588b8659b3aa2dc
• https://git.kernel.org/stable/c/d10855876a6f47add6ff621cef25cc0171dac162
• https://git.kernel.org/stable/c/d5730780e9ea84e5476752a47c749036c6a74af5

Get alerted when CVE-2022-50160 or the next vulnerability affects your stack