CVE-2022-50659: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50659 is a PCI device reference count leak vulnerability in the Linux kernel's hwrng: geode hardware random number generator driver. The flaw exists in the handling of for_each_pci_dev() loop exits — when the loop breaks with a non-NULL pdev, the driver fails to call pci_dev_put() to decrement the reference count, resulting in a resource leak. It affects Linux kernel versions from 2.6.18 up to the patched stable releases. The vulnerability was formally published on December 9, 2025, and is estimated as Medium severity with no official CVSS base score assigned (Feedly, ENISA EUVD).

The root cause is a missing reference count decrement (CWE-401: Missing Release of Memory after Effective Lifetime / resource leak) in the hwrng: geode driver within the Linux kernel. The for_each_pci_dev() macro is implemented via pci_get_device(), which increments the reference count of the returned pci_dev structure. If the loop is exited early (e.g., on error or successful device match) with pdev still non-NULL, the driver previously omitted the corresponding pci_dev_put() call, leaking the reference. The fix introduces a new amd_geode_priv struct to track the pci_dev pointer and membase, and adds the missing pci_dev_put() calls in both normal and error code paths (Feedly, Kernel Patch).

The primary impact of this vulnerability is a kernel-level resource leak: the PCI device reference count is not properly decremented, which can prevent the PCI device from being properly released or unbound. Over time or under repeated module load/unload cycles, this could contribute to memory exhaustion or incorrect device lifecycle management. The vulnerability does not directly enable remote code execution, privilege escalation, or data exfiltration, and its practical security impact is limited to systems using AMD Geode-based hardware with the affected driver (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50659. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system running an affected kernel on AMD Geode hardware, significantly limiting the attack surface (Feedly).

The Linux kernel stable team has released patches across multiple stable branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to the appropriate patched stable kernel version for their distribution. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, Kernel Patch).