CVE-2022-50659

Linux Kernel - Denial of Service via PCI Device Refcount Leak in Geode HWRNG Driver

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.

Scores

EPSS 0.0025
EPSS Percentile 16.1%

Details

Status published
Products (28)
linux/Kernel 2.6.18 - 4.9.337linux
linux/Kernel 4.10.0 - 4.14.303linux
linux/Kernel 4.15.0 - 4.19.270linux
linux/Kernel 4.20.0 - 5.4.229linux
linux/Kernel 5.11.0 - 5.15.86linux
linux/Kernel 5.16.0 - 6.0.16linux
linux/Kernel 5.5.0 - 5.10.163linux
linux/Kernel 6.1.0 - 6.1.2linux
Linux/Linux < 2.6.18
Linux/Linux 2.6.18
... and 18 more
Published Dec 09, 2025
Tracked Since Feb 18, 2026