CVE-2022-50846: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50846 is a Linux kernel vulnerability in the mmc: via-sdmmc driver caused by an unchecked return value from mmc_add_host(). If the error is ignored, it leads to a memory leak (from mmc_alloc_host()) and a potential kernel crash via null-pointer dereference in device_del() during the device removal path. The vulnerability affects the Linux kernel from version 2.6.31 up to the patched stable releases. It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.033% (Feedly, EUVD).

The root cause is improper error handling (CWE-252: Unchecked Return Value) in the via-sdmmc MMC host controller driver within the Linux kernel. When mmc_add_host() fails and its return value is not checked, two consequences follow: the memory allocated by mmc_alloc_host() is never freed (memory leak), and a subsequent call to mmc_remove_host() in the driver's remove() path attempts to delete a device that was never successfully registered, triggering a null-pointer dereference in device_del() and causing a kernel panic. The fix involves checking the return value of mmc_add_host() and branching to an error path that calls mmc_free_host() to release allocated resources (Feedly, EUVD).

Exploitation of this vulnerability can result in a kernel crash (denial of service) due to a null-pointer dereference in device_del() when the MMC device is removed after a failed mmc_add_host() call. Additionally, the memory leak degrades system stability over time. The impact is limited to systems using the VIA SD/MMC host controller driver (via-sdmmc), which is a relatively niche hardware component, reducing the overall attack surface (Feedly).

The Linux kernel stable tree has released patches addressing this vulnerability across multiple stable branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update their Linux kernel to one of these patched versions. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (EUVD, Feedly).