PT-2025-37569 · Linux+4 · Linux+4

Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-50267

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions linux (affected versions not specified)

Description The Linux kernel contains a flaw in the mmc subsystem, specifically within the rtsx pci driver. A failure to properly check the return value of the mmc add host() function can lead to a memory leak when the function returns an error. This memory leak occurs because memory allocated by mmc alloc host() is not freed. Subsequently, attempting to remove a device that was not fully added can cause a kernel crash. The issue is resolved by verifying the return value of mmc add host() and calling mmc free host() in the error path, as well as disabling runtime power management.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unchecked Return Value

NULL Pointer Dereference

Weakness Enumeration

CWE-252

CWE-476

Related Identifiers

BDU:2026-02520

CVE-2022-50267

SUSE-SU-2025:03615-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Astra Linux

Debian

Linux

Suse

Rtsx Pci

References · 864

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50267.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50267 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50267 · Security Note
• https://ubuntu.com/security/CVE-2022-50267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50267 · Security Note
• https://git.kernel.org/stable/c/30dc645461dfc63e52b3af8ee4a98e17bf14bacf · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory
• https://git.kernel.org/stable/c/ffa9b2a79e3e959683efbad3f6db937eca9d38f5 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:03628-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50267 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3716-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03615-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50267 · Vendor Advisory
• https://git.kernel.org/stable/c/0c87db77423a282b3b38b8a6daf057b822680516 · Patch
• https://git.kernel.org/stable/c/5cd4e04eccaec140da6fa04db056a76282ee6852 · Patch