CVE-2022-50653: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50653 is a Linux kernel vulnerability in the mmc: atmel-mci driver caused by an unchecked return value from mmc_add_host(). If the error is ignored, it leads to two issues: a memory leak from the allocation made in mmc_alloc_host(), and a potential kernel crash (null-pointer dereference in device_del()) during the device removal path when mmc_remove_host() is called on a device that was never successfully added. The vulnerability affects the Linux kernel from version 2.6.27 up to the patched stable releases. It was published on December 9, 2025, and is estimated as Medium severity with an EPSS score of 0.000240 (Feedly, CIRCL).

The root cause is an improper check for return values (CWE-252) in the atmel-mci MMC host controller driver within the Linux kernel. When mmc_add_host() fails and its return value is not checked, the driver proceeds without properly registering the MMC host device, leaving allocated memory unreleased and the internal state inconsistent. Subsequently, if the driver's remove() path is triggered, mmc_remove_host() attempts to delete a device that was never added, causing a null-pointer dereference in device_del() and a kernel crash. The fix involves checking the return value of mmc_add_host() and calling mmc_free_host() in the error path to properly release resources (Feedly, Kernel Git).

Exploitation of this vulnerability can result in a kernel crash (denial of service) via a null-pointer dereference in device_del() when the affected driver's remove path is triggered after a failed mmc_add_host() call. Additionally, the memory allocated by mmc_alloc_host() is leaked, contributing to resource exhaustion over time. The impact is limited to systems using the Atmel MCI MMC host controller driver, and there is no known path to privilege escalation or remote code execution from this flaw (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50653. The EPSS score is very low at 0.000240, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detectable via Nessus plugin 278091 (Tenable, Feedly).

The Linux kernel stable trees have been patched across multiple branches. Fixed versions include kernel 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to the appropriate patched stable kernel version for their distribution. SUSE has also issued advisories (e.g., SUSE-2026:0263-1, SUSE-2026:0317-1, SUSE-2026:0411-1) incorporating this fix (Feedly, Linux Security, Kernel Git).