CVE-2022-50760: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50760 is a PCI device reference count leak vulnerability in the Linux kernel's drm/amdgpu subsystem, specifically within the amdgpu_atrm_get_bios() function. The flaw arises because pci_get_class() returns a PCI device with its reference count incremented, but when the loop in amdgpu_atrm_get_bios() exits with a non-NULL pdev, the corresponding pci_dev_put() call to decrement the refcount is missing. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to various stable branch fix commits. No CVSS score has been assigned (base score 0.0), and the EPSS score is approximately 0.033% (Feedly, ENISA EUVD).

The root cause is a missing reference count decrement (CWE-401: Missing Release of Memory after Effective Lifetime / resource leak) in the AMD GPU BIOS retrieval path of the Linux kernel DRM subsystem. When amdgpu_atrm_get_bios() iterates over PCI devices using pci_get_class(), each call increments the refcount of the returned device and decrements the refcount of the previous @from parameter. If the loop breaks early with pdev still holding a non-NULL reference, the final pci_dev_put() is never called, causing a persistent reference count leak on that PCI device object. The fix adds the missing pci_dev_put() call at the appropriate exit paths to ensure proper resource cleanup (Feedly, Kernel Git).

The primary impact of this vulnerability is a kernel resource leak — specifically, a PCI device object whose reference count is never decremented to zero, preventing proper cleanup and potentially causing memory exhaustion over time. On systems with AMD GPUs that repeatedly load or reload the amdgpu driver (e.g., during suspend/resume cycles or driver reloads), the leaked references could accumulate and contribute to system instability or denial of service. There is no known confidentiality or integrity impact; the vulnerability does not enable privilege escalation, code execution, or data exfiltration (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Patched versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to a kernel version that includes the fix commit for their respective stable branch (e.g., 6611feef35c0 for one branch, a8b54ad7106c for another). SUSE has also issued advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) addressing this issue in their kernel packages (Feedly, Linux Security).