CVE-2022-49050: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49050 affects the Linux kernel's Renesas RPC-IF driver. The vulnerability was discovered in the memory subsystem where a platform-device leak occurs in the error path. This issue was identified and fixed in February 2025, impacting systems using the Renesas RPC-IF memory interface (Kernel Git).

The vulnerability stems from a failure to properly free the flash platform device when registration fails during probe. The issue occurs in the rpcif_probe function within the drivers/memory/renesas-rpc-if.c file. The bug was introduced with commit ca7d8b980b67 ("memory: add Renesas RPC-IF driver"). The CVSS score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicating moderate severity with local access required (Red Hat).

The vulnerability results in a memory leak when device registration fails during the probe sequence. While this doesn't lead to immediate system compromise, it can cause resource exhaustion over time as platform devices are not properly freed in error conditions.

The vulnerability requires local access with low privileges to trigger. No known exploits have been reported in the wild. The attack complexity is considered low, but requires specific conditions during device initialization to manifest.

The issue has been fixed by adding proper error handling in the rpcif_probe function to ensure the flash platform device is freed when registration fails. The fix involves storing the return value of platform_device_add() and calling platform_device_put() if an error occurs. Users should update to patched kernel versions that include the fix (Kernel Git).