CVE-2022-50718: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50718 is a PCI device reference count leak vulnerability in the Linux kernel's drm/amdgpu subsystem. The flaw exists in the amdgpu_device_resume and amdgpu_device_suspend_display_audio() functions, where pci_get_domain_bus_and_slot() returns a PCI device with an incremented reference count that is never decremented via pci_dev_put(). The vulnerability was published on December 24, 2025, and affects Linux kernel versions starting from 5.8 up to the patched releases. No CVSS score has been assigned; the EPSS score is approximately 0.000180 (Feedly, ENISA EUVD).

The root cause is a missing call to pci_dev_put() after pci_get_domain_bus_and_slot() is used within the AMD GPU display audio suspend/resume code path, classified as CWE-401 (Missing Release of Memory after Effective Lifetime) or more broadly as a resource leak. The pci_get_domain_bus_and_slot() API increments the reference count of the returned PCI device structure; failing to call pci_dev_put() before returning from amdgpu_device_resume|suspend_display_audio() causes the reference count to never reach zero, preventing proper cleanup. This is a local, kernel-space issue with no network attack vector, and exploitation would require local access to a system running an affected kernel with an AMD GPU (Feedly, ENISA EUVD).

The primary impact is a kernel resource leak — specifically, a PCI device reference count that is never decremented, which can prevent proper device cleanup and potentially lead to memory exhaustion or system instability over time, particularly on systems that frequently suspend and resume. This vulnerability does not directly enable unauthorized code execution, privilege escalation, or data exfiltration. The availability impact is the most relevant concern, as repeated triggering (e.g., through repeated suspend/resume cycles) could degrade system stability (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50718. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.000180 (very low probability of exploitation), reflecting its limited security impact and the requirement for local access to an affected system with AMD GPU hardware (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include Linux 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to these or later kernel versions. SUSE has also issued kernel security advisories (e.g., SUSE-2026:0263-1, SUSE-2026:0317-1, SUSE-2026:0411-1) incorporating this fix (Feedly, Linux Security SUSE).