PT-2025-37639 · Linux+1 · Linux Kernel+1

Published 2022-11-23 · Updated 2025-09-15 · CVE-2022-50337

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The get function 0() function in the Linux kernel contains a potential PCI device reference count leak. The function calls pci get domain bus and slot(), which increments the reference count of the PCI device. However, the reference is not always released, leading to a memory leak. Callers of get function 0() need to call pci dev put() to decrement the reference count and prevent the leak. The issue has been addressed by ensuring pci dev put() is called in the error path and by adding comments to inform callers about the need to release the device reference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-911

Related Identifiers

BDU:2026-02525

CVE-2022-50337

Affected Products

Astra Linux

Linux Kernel

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50337.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50337 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50337 · Security Note
• https://git.kernel.org/stable/c/27158c72678b39ee01cc01de1aba6b51c71abe2f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50337 · Vendor Advisory
• https://git.kernel.org/stable/c/a40e1b0a922a53fa925ea8b296e3de30a31ed028 · Patch
• https://git.kernel.org/stable/c/40ff4c2335a98f0ee96b099bfd70b8e6644f321f · Patch
• https://git.kernel.org/stable/c/37a13b274e4513c757e50c002ddcbf4bc89adbb2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50337 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50337 · Vendor Advisory
• https://git.kernel.org/stable/c/9a1b3148975b71fdc194e62612478346bbe618cd · Patch
• https://ubuntu.com/security/CVE-2022-50337 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50337 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02525 · Security Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.86 · Note