CVE-2022-50653

mmc: atmel-mci: fix return value check of mmc_add_host()

N/A
Published: December 9, 2025 at 12:00 AM UTC
Updated: June 17, 2026 at 05:23 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and calling mmc_free_host() in the error path.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.27 ≤ v < 4.19.2702.6.27 ≤ v < 5.10.1632.6.27 ≤ v < 5.15.862.6.27 ≤ v < 5.4.2292.6.27 ≤ v < 6.0.162.6.27 ≤ v < 6.1.22.6.27 ≤ v < 6.22.6.277d2be0749a59096a334c94dc48f43294193cb8ed
Vendor states this is fixed in 00ac0f5f95920f003cd6ece53cdc759549b69118 (fixed)
Vendor states this is fixed in 1925472dec31ec061d57412b3a65a056ea24f340 (fixed)
Vendor states this is fixed in 6bb26abb92f25e582a0976091a10b539fe3796db (fixed)
Vendor states this is fixed in 85946ceb0fac20ab39cdb85333086daf0291a553 (fixed)
Vendor states this is fixed in 99a6cdfa2cf05028b52f6d8ee85ccc5f8b71b4a2 (fixed)
Vendor states this is fixed in 9e6e8c43726673ca2abcaac87640b9215fd72f4c (fixed)
Vendor states this is fixed in cc8bb436f3c842a86b9082d97933582120d180e2 (fixed)
Vendor states this is fixed in 2.6.27 (unaffected)
Vendor states this is fixed in 4.19.270 (unaffected)
Vendor states this is fixed in 5.10.163 (unaffected)
Vendor states this is fixed in 5.15.86 (unaffected)
Vendor states this is fixed in 5.4.229 (unaffected)
Vendor states this is fixed in 6.0.16 (unaffected)
Vendor states this is fixed in 6.1.2 (unaffected)
Vendor states this is fixed in 6.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card