CVE-2022-50645: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50645 is a reference count (refcount) leak vulnerability in the Linux kernel's EDAC/i10nm subsystem, specifically within the pci_get_dev_wrapper() function. The bug arises because pci_get_domain_bus_and_slot() already returns a PCI device with an incremented reference count, but the code incorrectly calls an additional pci_dev_get(), and fails to release the device reference in the error path. The vulnerability affects Linux kernel versions from the introduction of the flawed code (commit d4dc89d069aa) up to the patched stable releases. It was published on December 9, 2025, and is estimated as Medium severity with an EPSS score of 0.000240 (Feedly, CIRCL).

The root cause is a reference counting error (CWE-911: Improper Update of Reference Count) in the pci_get_dev_wrapper() function within drivers/edac/i10nm_base.c. When pci_get_domain_bus_and_slot() is called, it returns a PCI device struct with its reference count already incremented; the code then redundantly calls pci_dev_get() on the same device, over-incrementing the refcount. Additionally, in the error path, the PCI device is not released via pci_dev_put(), causing a resource leak. The fix removes the extraneous pci_dev_get() call and adds the necessary pci_dev_put() in the error path, as reflected in multiple stable-branch patches (Kernel Git, Feedly).

The primary consequence of this vulnerability is a kernel resource leak: PCI device reference counts are not properly decremented, which can prevent proper device cleanup and potentially lead to memory exhaustion or system instability over time. In practice, this is a local kernel-level issue affecting availability (system stability) rather than confidentiality or integrity. The impact is limited to systems using Intel i10nm EDAC (Error Detection and Correction) hardware, and exploitation would require local access or the ability to trigger the affected code path repeatedly (Feedly, CIRCL).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50645. The EPSS score is very low at 0.000240, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable via Nessus plugin 278039 (Tenable, Feedly).

The vulnerability is fixed in the following Linux stable kernel versions: 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Administrators should update to one of these patched versions or apply the relevant stable-branch commits. The specific fix commits are available in the Linux stable kernel repository (Kernel Git, Kernel Git, Kernel Git). No configuration-based workaround is available; patching is the recommended remediation.