CVE-2022-50868: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50868 is a PCI device reference count leak vulnerability in the Linux kernel's AMD hardware random number generator (hwrng) driver. The flaw exists in the hwrng: amd driver, where the for_each_pci_dev() loop — implemented via pci_get_device() — increments the reference count of the returned pci_dev structure, but the code fails to call pci_dev_put() to decrement the reference count when breaking out of the loop early (in both normal and error paths). The vulnerability was published on December 30, 2025, and affects the Linux kernel from version 2.6.18 onward, with fixes backported to stable branches including 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. No CVSS base score has been assigned (scored 0.0), and the EPSS score is approximately 0.033% (Feedly, EUVD).

The root cause is a missing resource release (CWE-772: Missing Release of Resource after Effective Lifetime) in the AMD hwrng kernel driver (drivers/char/hw_random/amd-rng.c). The for_each_pci_dev() macro wraps pci_get_device(), which increments the reference count of each returned pci_dev; if the loop is exited early (e.g., via break on finding a matching device or encountering an error), the reference count of the last held pci_dev is never decremented because pci_dev_put() is not called. The fix adds the missing pci_dev_put() calls in both the normal exit path and the error path to properly release the PCI device reference. Patches are available across multiple stable kernel branches via the kernel.org stable tree (Feedly, EUVD).

The primary impact of this vulnerability is a kernel-level resource leak: each time the AMD hwrng driver initializes or encounters an error and exits the for_each_pci_dev() loop early, the reference count of the associated PCI device is not properly decremented. Over time, this can prevent the PCI device from being properly released or unbound, potentially causing memory exhaustion or preventing correct driver unloading and device management. This is a local, low-severity issue with no direct confidentiality or integrity impact; availability may be marginally affected on long-running systems with repeated driver load/unload cycles (Feedly).

Update the Linux kernel to a patched stable version: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2 and later. The fix adds pci_dev_put() calls in the AMD hwrng driver for both normal and error exit paths of the for_each_pci_dev() loop. As a workaround on systems not using AMD hardware RNG, the amd-rng kernel module can be blacklisted to prevent the driver from loading, though upgrading to a patched kernel is the recommended remediation (Feedly, EUVD).