LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50268: mmc: moxart: fix return value check of mmc_add_host()

In the Linux kernel, the following vulnerability has been resolved: mmc: moxart: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability flaw in the moxart MMC driver. If adding an MMC host fails, the driver may leak memory and later crash during removal. The public record does not provide CVSS, exploitation evidence, or impact beyond kernel crash.

Executive priority

Treat as a targeted kernel stability issue, not an emergency internet-scale vulnerability based on current evidence. Patch through normal kernel maintenance, with faster attention for embedded systems relying on moxart MMC support.

Technical view

The driver failed to check mmc_add_host() return status. On error, memory allocated by mmc_alloc_host() was not freed, and later remove-path handling could delete a device that was never added. Stable kernel commits add error handling that calls mmc_free_host().

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the moxart MMC host driver present and relevant hardware or code paths exercised. The source bundle lists multiple affected kernel branches but no distribution-specific package mapping.

Exploitation context

CISA KEV is false in the bundle, and no cited source claims active exploitation. The described impact is a kernel crash from an error-path bug, not a documented privilege escalation or remote attack.

Researcher notes

The record lacks CVSS, CWE, exploitability details, and distribution mapping. Analysis should stay tied to the driver error path and referenced stable commits unless vendor advisories provide more scope or impact detail.

Mitigation direction

  • Update to a kernel containing the referenced stable fixes or a vendor backport.
  • Check Linux distribution advisories for exact package versions and support status.
  • Prioritize systems using moxart MMC hardware or custom embedded kernel builds.
  • Track vendor guidance because no standalone workaround is named in the sources.

Validation and detection

  • Inventory kernel versions against the affected versions listed in the CVE source bundle.
  • Check whether moxart MMC support is enabled in deployed kernels.
  • Confirm vendor kernel changelogs include the referenced stable fix commits.
  • Review crash logs for MMC host add or remove-path failures on relevant devices.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50268 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627e, 1b66e94e6b9995323190f31c51d8e1a6f516627eunaffected
LinuxLinux3.16, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.