CVE-2022-50886: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50886 is a memory leak and potential kernel crash vulnerability in the Linux kernel's mmc: toshsd driver, caused by an unchecked return value from mmc_add_host(). When mmc_add_host() returns an error and the return value is ignored, memory allocated by mmc_alloc_host() is leaked, and a subsequent attempt to delete a device that was never added in the remove path can trigger a kernel crash. The vulnerability was published on December 30, 2025, and affects Linux kernel versions from the introduction of the toshsd driver (commit a5eb8bbd) up to the respective stable branch fixes. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.043% (Feedly).

The root cause is an improper check for return values (CWE-252) in the mmc: toshsd MMC host controller driver. Specifically, mmc_add_host() can return a non-zero error code indicating failure, but the driver did not check this return value, causing the allocated MMC host structure (from mmc_alloc_host()) to be leaked. Additionally, on the error path, free_irq() was not called, compounding the resource leak. The fix involves checking the return value of mmc_add_host(), branching to an error path that calls mmc_free_host() and free_irq() to properly release resources (Feedly, Kernel Git).

The primary impact is a kernel memory leak and potential kernel crash (denial of service) on systems using the Toshiba SD (toshsd) MMC host controller driver. If mmc_add_host() fails during device initialization, the unfreed memory and the subsequent attempt to remove a device that was never registered can destabilize or crash the kernel, affecting system availability. Confidentiality and integrity impacts are not directly associated with this vulnerability; it is primarily an availability issue limited to systems with the affected hardware and driver (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update their Linux kernel to one of these patched versions or later. No configuration-based workaround is available; upgrading the kernel is the recommended remediation. Systems not using Toshiba SD hardware or the toshsd kernel module are not affected (Feedly, Kernel Git).