CVE-2022-50640: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50640 is a kernel panic and memory corruption vulnerability in the Linux kernel's MMC (Multimedia Card) core subsystem, triggered when removing a non-standard SDIO card. The flaw exists because SDIO tuples are only allocated for standard SDIO cards, but the reference counter for non-standard SDIO card devices is not incremented in sdio_init_func(), while sdio_release_func() decrements the reference counter for all SDIO card devices — causing an imbalance that leads to memory corruption and kernel panic. The vulnerability affects Linux kernel versions from 2.6.36 through the unpatched stable branches, and was publicly disclosed on December 9, 2025. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Feedly).

The root cause is an improper reference counting flaw (CWE-911: Improper Update of Reference Count) in the Linux kernel's mmc/core subsystem. Specifically, sdio_init_func() does not call get_device() to increment the reference counter for non-standard SDIO card function devices, but sdio_release_func() unconditionally calls put_device() for all SDIO functions, including non-standard ones. This asymmetry results in a use-after-free or double-free condition when a non-standard SDIO card is removed, causing memory corruption and a kernel panic. Exploitation requires local access and the ability to physically insert and remove a non-standard SDIO card, or to trigger the card removal event through software means (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can result in kernel panic (denial of service), memory corruption, and potentially unauthorized access to kernel memory, affecting confidentiality, integrity, and availability at the kernel level. An attacker with local access who can trigger the removal of a non-standard SDIO card may crash the system or leverage the memory corruption for privilege escalation. The impact is scoped to the local system, but kernel-level memory corruption could theoretically be chained with other techniques for deeper compromise (Feedly).

Patches have been backported to multiple stable Linux kernel versions. Users should upgrade to one of the following patched releases: 4.9.332, 4.14.298, 4.19.264, 5.4.223, 5.10.153, 5.15.77, 6.0.7, or 6.1 and later. As a workaround, restricting physical access to SDIO card slots and limiting local user permissions can reduce exposure. Regularly applying kernel security updates from your distribution vendor (e.g., Red Hat, SUSE) is strongly recommended (Red Hat CVE, Red Hat Bugzilla, Feedly).