CVE-2022-49787: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49787 is a vulnerability discovered in the Linux kernel's MMC subsystem, specifically in the sdhci-pci driver. The vulnerability was disclosed on May 1, 2025, and involves a potential memory leak caused by a missing pci_dev_put() call (NVD, Wiz).

The vulnerability occurs when pci_get_device() increases the reference count for the returned pci_dev without a corresponding pci_dev_put() to decrease the reference count before amd_probe() returns. The issue has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (Red Hat, Wiz).

The primary impact of this vulnerability is a memory leak in the Linux kernel's MMC subsystem. While memory leaks typically don't pose immediate security risks, they can lead to system resource exhaustion over time, potentially affecting system stability and performance (NVD).

Red Hat has deferred fixing this issue in Red Hat Enterprise Linux 9. Some Linux distributions like Red Hat Enterprise Linux 7 and 8 are not affected by this vulnerability. For affected systems, updating to a patched version of the kernel when available is recommended (Red Hat).