CVE-2022-50858: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50858 is a memory leak and potential kernel crash vulnerability in the Linux kernel's MMC (MultiMediaCard) subsystem, specifically in the Alcor card reader driver (mmc/alcor). The flaw arises from the driver failing to check the return value of mmc_add_host(), which can cause memory allocated by mmc_alloc_host() to be leaked and subsequently trigger a kernel crash when the device is removed (due to attempting to delete a device that was never successfully added). It was published on December 30, 2025, and affects Linux kernel versions from the introduction of the Alcor driver up to the patched stable releases. The CVSS estimate is Medium severity (Feedly, EUVD).

The root cause is an improper return value check (CWE-252: Unchecked Return Value) in the mmc/alcor driver within the Linux kernel. When mmc_add_host() fails, the driver does not handle the error, leaving the memory allocated by mmc_alloc_host() unreleased (memory leak). Additionally, during the driver's remove path, the code attempts to delete a device that was never successfully registered, leading to a kernel crash. The fix involves checking the return value of mmc_add_host() and calling mmc_free_host() in the error path to properly release resources (Feedly).

Successful triggering of this vulnerability results in a kernel memory leak and potential kernel crash (denial of service) on systems using the Alcor MMC card reader driver. The availability impact is the primary concern, as a kernel crash would render the affected system inoperable until rebooted. There is no known confidentiality or integrity impact, and exploitation is limited to the local system context where the affected hardware is present (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50858. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access to a system with the Alcor MMC hardware and the ability to trigger driver load/unload cycles.

The Linux kernel stable trees have been patched across multiple branches. Fixed versions include Linux 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update to these or later stable kernel releases. The relevant upstream patches are available in the kernel stable repository (Feedly). As a workaround, systems not using Alcor MMC hardware can blacklist the alcor_pci kernel module to prevent the driver from loading.