CVE-2022-50246: usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-15 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() I got the following report while doing device(mt6370-tcpc) load test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@34/tcpc/connector The 'fwnode' set in tcpci_parse_config() which is called in tcpci_register_port(), its node refcount is increased in device_get_named_child_node(). It needs be put while exiting, so call fwnode_handle_put() in the error path of tcpci_register_port() and in tcpci_unregister_port() to avoid leak.

Affected products

Linux kernel: from 4.19 before 5.4.229; from 5.5 before 5.10.163; from 5.11 before 5.15.86; from 5.16 before 6.0.16; from 6.1 before 6.1.2 — fixed in 5.10.163, 5.15.86, 5.4.229, 6.0.16, 6.1.2

How to fix

Upgrade to a fixed version: Linux kernel 5.10.163, 5.15.86, 5.4.229, 6.0.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-50246 or the next vulnerability affects your stack