CVE-2022-50670: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50670 is a Linux kernel vulnerability in the mmc: omap_hsmmc driver caused by an unchecked return value from mmc_add_host(). If the return value is ignored, it can lead to a memory leak (from mmc_alloc_host()) and a kernel crash via null-pointer dereference in device_del() during the device removal path. The vulnerability affects the Linux kernel starting from version 2.6.29 and was publicly disclosed on December 9, 2025. Fixed versions include Linux kernel 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The CVSS estimate is Medium severity with an EPSS score of 0.000240 (Red Hat CVE, Feedly).

The root cause is an improper check for return values (CWE-252) in the omap_hsmmc MMC host controller driver within the Linux kernel. When mmc_add_host() fails and its return value is not checked, two issues arise: allocated memory from mmc_alloc_host() is leaked, and during the driver's remove() path, mmc_remove_host() attempts to delete a device that was never successfully added, triggering a null-pointer dereference in device_del(). The fix involves checking the return value of mmc_add_host() and branching to an error path that calls mmc_free_host() to properly release resources. This is a local, kernel-level bug requiring physical or privileged access to trigger via device attachment/detachment scenarios (Red Hat CVE, Feedly).

Exploitation of this vulnerability can result in a kernel crash (denial of service) due to a null-pointer dereference in device_del() when a device removal is attempted after a failed mmc_add_host() call. Additionally, memory allocated by mmc_alloc_host() is leaked, potentially degrading system stability over time. The impact is limited to availability (system crash/reboot) and does not directly expose confidential data or allow privilege escalation (Red Hat CVE).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50670. The EPSS score is very low at 0.000240, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It is detected by Nessus plugin 278042 (Tenable, Feedly).

Apply the upstream Linux kernel patches that fix the return value check in the omap_hsmmc driver. Fixed versions are: 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Distributions such as SUSE have released updated kernel packages addressing this issue (e.g., SUSE advisories SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1). Users should update their Linux kernel to a patched version as soon as possible via their distribution's package manager (Red Hat CVE, Linux Security).

Red Hat has tracked this vulnerability and published a CVE entry. SUSE has issued multiple kernel security advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) that include fixes for CVE-2022-50670. No notable researcher commentary or significant social media discussion has been observed beyond routine vulnerability tracking (Red Hat CVE, Linux Security).