CVE-2022-50659
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-09

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-09
Last Modified
2025-12-09
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-15
NVD
CVE-2022-50659
EUVD
EUVD-2022-55746
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves a reference count leak in the Linux kernel's hwrng: geode driver. The function for_each_pci_dev() uses pci_get_device(), which increases the reference count of a pci_dev object. If the loop is broken early and the pci_dev pointer is not NULL, pci_dev_put() must be called to decrease the reference count. The vulnerability was caused by missing calls to pci_dev_put() in both normal and error paths, leading to a reference count leak. The fix added a new structure to track the pci_dev pointer and ensured pci_dev_put() is called appropriately.

Impact Analysis

The reference count leak can lead to resource leaks in the kernel, potentially causing increased memory usage or instability over time. This may degrade system performance or reliability, especially in systems using the affected hwrng: geode driver.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-50659. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart