CVE-2022-50769: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50769 is a memory leak and potential kernel crash vulnerability in the Linux kernel's MMC (MultiMediaCard) subsystem, specifically in the mxcmmc driver. The flaw arises from the driver failing to check the return value of mmc_add_host(), which can result in a memory leak of the allocation made by mmc_alloc_host() and a kernel crash when the device is removed (due to attempting to delete a device that was never successfully added). The vulnerability affects Linux kernel versions from 2.6.29 up to the fixed stable releases. It was published on December 24, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.033% (Feedly, EUVD).

The root cause is an improper return value check (CWE-252: Unchecked Return Value) in the mxcmmc MMC host controller driver (drivers/mmc/host/mxcmmc.c). When mmc_add_host() fails, the driver previously ignored the error and continued execution; upon device removal, the kernel would attempt to delete a device that was never registered, triggering a kernel crash. Additionally, the memory allocated by mmc_alloc_host() would not be freed, constituting a kernel memory leak. The fix adds proper error-path handling that calls mmc_free_host() when mmc_add_host() returns an error (Feedly, Kernel Git).

Exploitation of this vulnerability can lead to a kernel crash (denial of service) and kernel memory leakage on affected Linux systems using the Freescale/NXP i.MX SoC MMC controller (mxcmmc driver). The impact is primarily an availability concern — a system crash during device removal — along with a minor integrity/confidentiality risk from leaked kernel memory. The vulnerability is local in nature and requires the affected hardware to be present, limiting its scope to embedded or IoT systems using i.MX-based platforms (Feedly).

The Linux kernel stable trees have been patched across multiple supported branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to the appropriate patched stable kernel release for their branch. SUSE has also issued kernel security advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) addressing this issue. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, Linux Security).