Security readout for executives and security teams
Plain-English summary
CVE-2022-50353 is a Linux kernel availability bug in the wmt-sdmmc MMC/SD host driver. If a host-add operation fails, the driver can mishandle cleanup, leak allocated memory, and later crash the kernel during removal. The published impact is denial of service, not data theft or code execution.
Executive priority
Treat this as routine-to-prioritized kernel maintenance, higher for multi-user, embedded, or operational systems where a local crash would disrupt service. It does not currently justify emergency response based on the provided evidence.
Technical view
The bug is an unchecked mmc_add_host() return value after mmc_alloc_host(). On failure, cleanup skipped mmc_free_host() and clk_disable_unprepare(), leaving state that can cause a kernel crash when removing a device that was never added. CVSS is 5.5: local attack vector, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with the wmt-sdmmc driver present and usable. Systems without this driver are likely not exposed. The source bundle does not identify specific distributions, devices, or configurations beyond Linux kernel versions and upstream stable commits.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The CVSS vector indicates local, low-privilege conditions could trigger availability impact. No evidence in the provided sources supports remote exploitation, confidentiality impact, integrity impact, or public weaponization.
Researcher notes
The vulnerable behavior is cleanup-path error handling in the wmt-sdmmc driver, not a broad MMC subsystem takeover. Analysis should focus on whether mmc_add_host() failure paths are reachable in the target configuration and whether downstream kernels carry the stable fix.
Mitigation direction
- Update to a vendor kernel containing the referenced upstream stable fix.
- If updating is delayed, check vendor guidance for supported mitigations.
- Inventory systems for affected Linux versions and wmt-sdmmc driver usage.
- Prioritize systems where local users or workloads can access relevant MMC/SD hardware paths.
Validation and detection
- Confirm the running kernel version against vendor advisories and the CVE record.
- Check whether the wmt-sdmmc driver is built, loaded, or required.
- Verify vendor kernel changelogs include the referenced stable commit for your branch.
- After patching, confirm the updated kernel is booted, not only installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50353 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/70b0620afab3c69d95a7e2dd7ceff162a21c4009CVE reference, Linux
- https://git.kernel.org/stable/c/ecd6f77af3478f5223aa4011642a891b7dc91228CVE reference, Linux
- https://git.kernel.org/stable/c/c7a328cea791cc2769b6417943939420913b4a46CVE reference, Linux
- https://git.kernel.org/stable/c/9bedf64dda84b29151e41591d8ded9ff0e6d336aCVE reference, Linux
- https://git.kernel.org/stable/c/58c3a8d0f1abeb1ca5c2df948be58ad4f7bb6f67CVE reference, Linux
- https://git.kernel.org/stable/c/b40ac3b696a9c84b36211ef0c3f5a422650c101bCVE reference, Linux
- https://git.kernel.org/stable/c/eb7a2d516d4fbd165c07877a20feccb047342b1fCVE reference, Linux
- https://git.kernel.org/stable/c/29276d56f6ed138db0f38cd31aedc0b725c8c76cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.